CVE-2023-45140 Group-based JIT MFA bypass on scp and sftp in The Bastion
Attackers can bypass group-based JIT MFA when using SCP or SFTP through The Bastion, gaining unauthorized access without the required second factor.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-45140?
CVE-2023-45140 is a medium-severity authentication bypass vulnerability in ovh the-bastion, published on 8 Nov 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.
Weakness: CWE-306
Which versions are affected by CVE-2023-45140?
It affects 1 product.
Products include Ovh The-Bastion.
How do I fix CVE-2023-45140?
No fix has been published for CVE-2023-45140 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-45140 being exploited?
There is no known exploitation of CVE-2023-45140 in the wild and no public exploit code.
Sources
Also known as GHSA-pr4q-w883-pf5x.