PT-2023-32366 · Hashicorp · Hashicorp Vagrant

CVE-2023-5834 · Publicado 2023-10-27 · Atualizado 2023-11-13

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vagrant versions prior to 2.4.0

Description The issue concerns HashiCorp Vagrant's Windows installer, which targeted a custom location with a non-protected path that could be junctioned. This introduced the potential for unauthorized file system writes.

Recommendations For versions prior to 2.4.0, update to Vagrant 2.4.0 to resolve the issue. As a temporary workaround, consider restricting access to the custom location targeted by the Windows installer to minimize the risk of exploitation.

Exploit

Correção

Insecure Operation on Windows Junction

Link Following

Enumeração de Fraquezas

CWE-1386

CWE-59

Identificadores relacionados

CVE-2023-5834

GHSA-47XW-VW6M-W9FQ

Produtos afetados

Hashicorp Vagrant

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5834.json · Exploit
• https://github.com/hashicorp/vagrant · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-5834 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-47xw-vw6m-w9fq · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1718062252547276969 · Publicação no Twitter
• https://discuss.hashicorp.com/t/hcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write/59568 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-5834 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1718015772918960228 · Publicação no Twitter