PT-2023-29435 · Unknown · The Bastion

Thibaultdewailly · Published 2023-11-08 · Updated 2023-11-16 · CVE-2023-45140

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Bastion versions prior to 3.14.15

Description The Bastion provides authentication, authorization, traceability, and auditability for SSH accesses. However, SCP and SFTP plugins do not honor group-based Just-In-Time (JIT) Multi-Factor Authentication (MFA). This means that establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for an additional factor. This issue only applies to per-group-based JIT MFA, and other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis, and JIT MFA on a per-account basis, are not affected.

Recommendations For versions prior to 3.14.15, update to version 3.14.15 to resolve the issue. As a temporary workaround, consider disabling the group-based JIT MFA feature until the patch is applied. Restrict access to the SCP and SFTP plugins to minimize the risk of exploitation. Avoid using group-based access for SCP/SFTP connections until the issue is resolved.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-45140

GHSA-PR4Q-W883-PF5X

Affected Products

The Bastion

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45140.json · Exploit
• https://github.com/ovh/the-bastion/releases/tag/v3.14.15 · Patch
• https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45140 · Security Note
• https://twitter.com/VulmonFeeds/status/1722314670281765248 · Twitter Post
• https://twitter.com/CVEnew/status/1722277494185926902 · Twitter Post