Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

[tgross]

Affected Products / Versions: Nomad and Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10; fixed in 1.6.0, 1.5.7, and 1.4.11.

Summary:
A vulnerability was identified in Nomad Enterprise (“Nomad”) such that the API caller’s ACL token secret ID is exposed to sentinel policies. This vulnerability, CVE-2023-3299, affects Nomad from 1.2.11 up to 1.5.6, and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.

Background:
Nomad provides an expressive policy-as-code system called Sentinel which can be used by administrators to enforce criteria for jobs submitted to a cluster. Authoring or enforcing these Sentinel policies in a cluster requires management-level (administrative) privileges.

Details:
Internal testing by the Nomad engineering team identified that Sentinel policies could access a caller’s ACL token secret ID, which is not strictly required to enforce policies.

This can allow a poorly specified policy to access the token's secret ID and risk leaking it to command and API output if printed. This requires a management token to submit a Sentinel policy to a Nomad cluster and the policy must read the secret from the token explicitly (as nomad_acl_token.secret_id).

More requirements and recommendations for a secure Nomad deployment can be found in the security model.

Remediation:
Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 1.6.0, 1.5.7, and 1.4.11, or newer.

See Nomad’s Upgrading for general guidance on this process.

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.