PT-2025-27667 · Hashicorp · Hashicorp Vagrant

Bcoles · Published 2021-01-19 · Updated 2025-07-04 · CVE-2025-34075

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: HashiCorp Vagrant (affected versions not specified)

Description: An authenticated virtual machine escape issue exists in HashiCorp Vagrant when using the default synced folder configuration. This configuration automatically mounts the host system's project directory into the guest VM, including the Vagrantfile configuration file, which is a Ruby script evaluated by the host. A low-privileged attacker with shell access to the guest VM can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host runs a vagrant command, the injected code is executed on the host with that user's privileges. This enables guest-to-host code execution in multi-tenant or adversarial VM scenarios.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Code Injection

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-276

CWE-94

CWE-668

Related Identifiers

BDU:2025-08055

CVE-2025-34075

GHSA-HQP6-MJW3-F586

Affected Products

Hashicorp Vagrant

References · 20

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/vagrant/CVE-2025-34075.yml · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/local/vagrant_synced_folder_vagrantfile_breakout.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34075 · Security Note
• https://osv.dev/vulnerability/GHSA-hqp6-mjw3-f586 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-34075 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08055 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-34075 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-34075 · Security Note
• https://github.com/hashicorp/vagrant/commit/abe87b2fdc124ef426c016d44d2f6f4792f0cbe3 · Note
• https://github.com/hashicorp/vagrant/issues/13688 · Note
• https://github.com/hashicorp/vagrant · Note
• https://developer.hashicorp.com/vagrant/docs/vagrantfile · Note
• https://vulncheck.com/advisories/hashicorp-vagrant-synced-folder-vagrantfile-breakout · Note
• https://developer.hashicorp.com/vagrant · Note
• https://twitter.com/VulmonFeeds/status/1940555474190930216 · Twitter Post