CVE-2023-3114 Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool
Unauthorized agents can target agent pools, potentially allowing access to resources from higher-privileged workspaces in the same organization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3114?
CVE-2023-3114 is a medium-severity missing authorization vulnerability in HashiCorp Terraform Enterprise, published on 22 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.
Which versions are affected by CVE-2023-3114?
It affects 1 product.
Products include Hashicorp Terraform Enterprise.
How do I fix CVE-2023-3114?
No fix has been published for CVE-2023-3114 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-3114 being exploited?
There is no known exploitation of CVE-2023-3114 in the wild and no public exploit code.
Other vulnerabilities in HashiCorp Terraform Enterprise
Sources
Also known as GHSA-fhmj-jv7w-vvg2.