Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

Vulnerability

Overview

CVE-2023-3299 affects HashiCorp Nomad Enterprise versions 1.2.11 through 1.5.6 and 1.4.10. The vulnerability arises when ACL policies use a block without a label, causing the API caller's ACL token secret ID to be inadvertently exposed to Sentinel policies [1][3]. This exposure is not required for policy enforcement and can lead to unintended disclosure of sensitive credentials.

Exploitation

Prerequisites

Exploitation requires management-level privileges to submit a Sentinel policy to a Nomad cluster. An attacker must explicitly read the secret ID from the token using the expression nomad_acl_token.secret_id within the policy [3]. This means only users with administrative access can directly exploit the flaw, but the risk is that a poorly written policy could leak the secret ID to command or API output.

Impact

If successfully exploited, an attacker with a management token could craft a Sentinel policy that captures the secret ID of the caller's ACL token. This could lead to token theft and subsequent unauthorized access to the Nomad cluster, potentially compromising the entire workload orchestration environment [3].

Mitigation

HashiCorp has fixed this vulnerability in Nomad Enterprise versions 1.6.0, 1.5.7, and 1.4.11 [1][3]. Users are strongly advised to upgrade to these versions or later. No workarounds are documented; upgrading is the recommended remediation.