Fulcio vulnerabilities

Prior to 1.8.5, Fulcio's metaRegex() function uses an unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. The SSRF can only trigger GET requests, cannot mutate state, and the response is not returned, so only blind SSRF is possible.

Fulcio, a certificate authority for issuing code signing certificates for OIDC identities, versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts.

Fulcio prior to 1.8.3 contains a vulnerability in the identity.extractIssuerURL function, which splits its untrusted argument on periods. A malicious request with an invalid OIDC identity token containing many period characters causes allocations of O(n) bytes, where n is the argument length, with a constant factor of about 16.