PT-2023-23657 · Neuvector · Neuvector

Dejan Zelic · Published 2023-10-06 · Updated 2024-10-16 · CVE-2023-32188

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 5.2.2

Description A user can reverse engineer the JSON Web Token (JWT) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector, potentially leading to Remote Code Execution (RCE).

Recommendations For versions prior to 5.2.2, upgrade to NeuVector version 5.2.2 or later and use the latest Helm chart (2.6.3+). As a temporary workaround, users can replace the Manager & Controller certificate manually by following the instructions provided in the documentation. However, upgrading to 5.2.2 and replacing the Manager/REST API certificate is recommended to provide additional security enhancements to prevent possible attempted exploit and resulting RCE.

Fix

Weakness Enumeration

CWE-1270

Related Identifiers

CVE-2023-32188

GHSA-622H-H2P8-743X

GO-2024-3201

Affected Products

Neuvector

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2023-32188 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32188 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-622h-h2p8-743x · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22644 · Security Note
• https://github.com/neuvector/neuvector/security/advisories/GHSA-622h-h2p8-743x · Note
• https://github.com/neuvector/neuvector · Note
• https://twitter.com/FatmaYl32625315/status/1710667772156383542 · Twitter Post
• https://twitter.com/Komodosec/status/1710607440331657513 · Twitter Post
• https://twitter.com/CveFindCom/status/1846476492445782497 · Twitter Post
• https://open-docs.neuvector.com/releasenotes/5x · Note
• https://twitter.com/CVEnew/status/1846472458771313032 · Twitter Post
• https://t.me/cvenotify/98242 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1846501204722851866 · Twitter Post
• https://twitter.com/Dinosn/status/1710595188622496151 · Twitter Post