CVE-2022-24797

CVE-2022-24797 affects Pomerium, an identity-aware access proxy, specifically when operating in distributed service mode. The vulnerability allows untrusted traffic to access pprof debug and Prometheus metrics handlers on the Authenticate service, potentially exposing sensitive environmental information or leading to denial-of-service conditions. This critical vulnerability (CVSS 9.1) has a low attack complexity and requires no user interaction, allowing an unauthenticated attacker to achieve high confidentiality impact and high availability impact. There is currently no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or significant community discussion has been observed. The issue is patched in Pomerium version v0.17.1, and a workaround involves blocking access to /debug and /metrics paths on the Authenticate service.