CVE-2021-27099: 
NixOS vulnerability analysis and mitigation

CVE-2021-27099 affects SPIRE (SPIFFE Runtime Environment) versions before 0.8.5, 0.9.4, 0.10.2, 0.11.3, and 0.12.1. The vulnerability was discovered on February 10, 2021, and publicly disclosed on March 4, 2021. The issue resides in the 'aws_iid' Node Attestor component which improperly normalizes paths provided through the agent ID templating feature (GHSA Advisory).

The vulnerability stems from improper path normalization in the 'aws_iid' Node Attestor when handling agent ID templating. The issue has a CVSS 3.1 Base Score of 6.8 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. The vulnerability is classified under CWE-863 (Incorrect Authorization) (NVD).

If exploited, this vulnerability could allow an attacker who controls the value of an EC2 tag prior to attestation to obtain an arbitrary SPIFFE ID within the same trust domain, when the attestor is configured for agent ID templating where the tag value is the last element in the path (GHSA Advisory).

The vulnerability requires the attacker to have control over EC2 tag values and the aws_iid attestor must be configured to use agent ID templating with the tag value as the last path element. The attack complexity is rated as high, requiring low privileges and no user interaction (NVD).

The vulnerability has been fixed in SPIRE versions 0.11.3 and 0.12.1. For those unable to upgrade immediately, workarounds include discontinuing the use of aws_iid agent ID templating or ensuring EC2 tag values are not utilized in aws_iid agent ID templating. Additionally, organizations with layered security controls should ensure all IDs are normalized prior to making policy decisions (GHSA Advisory).