PT-2023-9289 · Hashicorp+1 · Hashicorp Vault+2

CVE-2023-5077 · Publicado 2023-09-28 · Atualizado 2024-09-26

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.13.0

Description The issue is related to the Google Cloud secrets engine in HashiCorp Vault and Vault Enterprise, where existing Google Cloud IAM Conditions were not preserved upon creating or updating rolesets. This could potentially allow a remote attacker to elevate their privileges. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions prior to 1.13.0, update to Vault 1.13.0 to resolve the issue. As a temporary workaround, consider restricting access to the Google Cloud secrets engine until the update is applied. Avoid using the Google Cloud secrets engine for creating or updating rolesets until the issue is resolved.

Exploit

Correção

DoS

Incorrect Privilege Assignment

Incorrect Permission

Enumeração de Fraquezas

CWE-266

CWE-732

Identificadores relacionados

BDU:2024-06028

BIT-VAULT-2023-5077

CVE-2023-5077

GHSA-86C6-3G63-5W64

GO-2023-2088

Produtos afetados

Hashicorp Vault

Red Os

Vault Enterprise

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5077.json · Exploit
• https://github.com/hashicorp/vault · Nota
• https://osv.dev/vulnerability/CVE-2023-5077 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1707628566341370330 · Publicação no Twitter
• https://t.me/cvenotify/96257 · Publicação no Telegram
• https://twitter.com/cracbot/status/1707998749539336608 · Publicação no Twitter
• https://t.me/cvenotify/58737 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-5077 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-86c6-3g63-5w64 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-06028 · Nota de Segurança
• https://osv.dev/vulnerability/GO-2023-2088 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-vault-2023-5077 · Aviso do Fabricante
• https://github.com/advisories/GHSA-86c6-3g63-5w64 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-vault-05-08-24 · Nota
• https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654 · Aviso do Fabricante