id: GO-2024-2671
modules:
    - module: github.com/hashicorp/nomad
      versions:
        - introduced: 0.11.0
        - fixed: 1.4.11
        - introduced: 1.5.0
        - fixed: 1.5.7
      vulnerable_at: 1.4.10
      packages:
        - package: github.com/hashicorp/nomad/acl
          symbols:
            - ACL.AllowVariableSearch
        - package: github.com/hashicorp/nomad/nomad
          symbols:
            - sufficientSearchPerms
            - filteredSearchContexts
            - getEnterpriseFuzzyResourceIter
          derived_symbols:
            - ACL.GetPolicies
            - ACL.GetPolicy
            - ACL.GetRoleByID
            - ACL.GetRoleByName
            - ACL.GetRolesByID
            - ACL.GetToken
            - ACL.GetTokens
            - ACL.ListPolicies
            - ACL.ListRoles
            - ACL.ListTokens
            - Alloc.GetAlloc
            - Alloc.GetAllocs
            - Alloc.GetServiceRegistrations
            - Alloc.List
            - CSIPlugin.Get
            - CSIPlugin.List
            - CSIVolume.Get
            - CSIVolume.List
            - Deployment.Allocations
            - Deployment.GetDeployment
            - Deployment.List
            - Eval.Allocations
            - Eval.Count
            - Eval.GetEval
            - Eval.List
            - Job.Allocations
            - Job.Deployments
            - Job.Dispatch
            - Job.Evaluations
            - Job.GetJob
            - Job.GetJobVersions
            - Job.GetServiceRegistrations
            - Job.LatestDeployment
            - Job.List
            - Job.Plan
            - Job.ScaleStatus
            - Job.Summary
            - Keyring.Get
            - Keyring.List
            - Namespace.GetNamespace
            - Namespace.GetNamespaces
            - Namespace.ListNamespaces
            - NewServer
            - NewWorker
            - Node.GetAllocs
            - Node.GetClientAllocs
            - Node.GetNode
            - Node.List
            - PeriodicDispatch.SetEnabled
            - Scaling.GetPolicy
            - Scaling.ListPolicies
            - Search.FuzzySearch
            - Search.PrefixSearch
            - Server.Reload
            - Server.RunningChildren
            - Server.SetSchedulerWorkerConfig
            - ServiceRegistration.GetService
            - ServiceRegistration.List
            - TestACLServer
            - TestServer
            - TestServerErr
            - Variables.List
            - Variables.Read
            - Worker.Start
            - nomadFSM.Apply
            - nomadFSM.Restore
            - nomadFSM.RestoreWithFilter
summary: CSI plugin names disclosure in github.com/hashicorp/nomad
description: |-
    A vulnerability was identified in Nomad such that the search HTTP API
    can reveal names of available CSI plugins to unauthenticated users or
    users without the plugin:read policy. This vulnerability affects Nomad
    since 0.11.0 and was fixed in 1.4.11 and 1.5.7.
cves:
    - CVE-2023-3300
ghsas:
    - GHSA-v5fm-hr72-27hx
credits:
    - anonymous4ACL24
references:
    - fix: https://github.com/hashicorp/nomad/commit/a8789d3872bbf1b1f420f28b0f7ad8532a41d5e3
    - web: https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272
review_status: REVIEWED