PT-2020-15705 · Hashicorp · Vault-Ssh-Helper

Published 2020-08-20 · Updated 2024-08-21 · CVE-2020-24359

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp vault-ssh-helper versions 0.1.6 and earlier

Description The issue arises from improper input validation in the vault-ssh-helper, where it incorrectly accepted Vault-issued SSH OTPs for the subnet of a host's network interface rather than the specific IP address assigned to that interface.

Recommendations For versions 0.1.6 and earlier, update to version 0.2.0 to resolve the issue. As a temporary workaround, consider restricting the use of Vault-issued SSH OTPs to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-24359

GHSA-F9FQ-VJVH-779P

GO-2022-0824

Affected Products

Vault-Ssh-Helper

References · 8

• https://osv.dev/vulnerability/GO-2022-0824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24359 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24359 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f9fq-vjvh-779p · Vendor Advisory
• https://github.com/hashicorp/vault-ssh-helper/releases · Note
• https://github.com/hashicorp/vault-ssh-helper/blob/master/CHANGELOG.md#020-august-19-2020 · Note
• https://github.com/hashicorp/vault-ssh-helper/commit/83effd08cbcbe4b993d776bd9b39465cd9e4603f · Note
• https://github.com/advisories/GHSA-f9fq-vjvh-779p · Note