CVE-2020-24359 Improper Input Validation in vault-ssh-helper
Attackers can use SSH OTPs for any IP in the host's subnet, bypassing specific IP restrictions in HashiCorp Vault SSH helper.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-24359?
CVE-2020-24359 is a high-severity authentication bypass vulnerability in n/a, published on 20 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.
Weakness: CWE-20
Which versions are affected by CVE-2020-24359?
3 open source packages ship an affected version, including github.com/hashicorp/vault-ssh-helper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/vault-ssh-helper Go | All versions | 0.2.0 |
github.com/hashicorp/vault-ssh-helper Go | All versions | 0.2.0 |
github.com/hashicorp/vault-ssh-helper Go | All versions | 0.2.0 |
Products include Hashicorp Vault-Ssh-Helper.
How do I fix CVE-2020-24359?
Upgrade github.com/hashicorp/vault-ssh-helper to 0.2.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-24359 being exploited?
There is no known exploitation of CVE-2020-24359 in the wild and no public exploit code.
Sources
Also known as GHSA-f9fq-vjvh-779p, GO-2022-0824.