PT-2023-9602 · Hashicorp+2 · Hashicorp Vault+3

Rob Zimmerman + 1 · Published 2023-09-14 · Updated 2024-10-15 · CVE-2023-4680

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions 1.6.0 through 1.12.10 HashiCorp Vault and Vault Enterprise versions 1.13.0 through 1.13.6 HashiCorp Vault and Vault Enterprise versions 1.14.0 through 1.14.2

Description The issue is related to improper input validation in the transit secrets engine of HashiCorp Vault and Vault Enterprise. This allows authorized users to specify arbitrary nonces, even when convergent encryption is disabled. The encrypt endpoint can be used in combination with an offline attack to decrypt arbitrary ciphertext and potentially derive the authentication subkey.

Recommendations For HashiCorp Vault and Vault Enterprise versions 1.6.0 through 1.12.10, update to version 1.12.11. For HashiCorp Vault and Vault Enterprise versions 1.13.0 through 1.13.6, update to version 1.13.7. For HashiCorp Vault and Vault Enterprise versions 1.14.0 through 1.14.2, update to version 1.14.3. As a temporary workaround, consider restricting access to the encrypt endpoint until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-323

Related Identifiers

ALT-PU-2024-3459

ALT-PU-2024-3678

ALT-PU-2024-4187

BDU:2024-08718

BIT-VAULT-2023-4680

CVE-2023-4680

GHSA-V84F-6R39-CPFC

GO-2023-2063

Affected Products

Alt Linux

Hashicorp Vault

Red Os

Vault Enterprise

References · 13

• https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2063 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2023-4680 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4680 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4680 · Security Note
• https://bdu.fstec.ru/vul/2024-08718 · Security Note
• https://osv.dev/vulnerability/GHSA-v84f-6r39-cpfc · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-vault-cve-2023-4680 · Note
• https://github.com/advisories/GHSA-v84f-6r39-cpfc · Note
• https://t.me/cvenotify/96180 · Telegram Post
• https://twitter.com/CVEnew/status/1702461089156415497 · Twitter Post
• https://redos.red-soft.ru/support/secure · Note