Nomad ACL Policies without Label are Applied to Unexpected Resources

[tgross]

Affected Products / Versions: Nomad and Nomad Enterprise 0.7 up to 1.5.6 and 1.4.10; fixed in 1.6.0, 1.5.7, and 1.4.11.

Summary:
A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such an ACL policy using a block without label generates unexpected results. This vulnerability, CVE-2023-3072, affects Nomad from 0.7 up to 1.5.6 and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.

Background:
Nomad provides an ACL policy system to enable authorization for the HTTP API. Administrators author ACL policies using HCL syntax and apply these policies to the cluster. Users present an ACL token linked to specific policies to the HTTP API when using the CLI or UI.

Details:
Internal testing by the Nomad engineering team identified that policies that expect a label, but don't specify one, can be applied to unexpected resources. For example, the policy below is applied to a namespace called policy.

namespace {
  policy = "read"
}

This can lead cluster administrators to create policies that allow access to unintended resources. For namespace in particular, the Nomad documentation explicitly states that this is a supported use-case and that the policy is applied to the default namespace.

More requirements and recommendations for a secure Nomad deployment can be found in the security model.

Remediation:
Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 1.6.0, 1.5.7, and 1.4.11, or newer.

See Nomad’s Upgrading for general guidance on this process.