CVE-2024-0831 Vault May Expose Sensitive Information When Configuring An Audit Log Device
Attackers can read sensitive data from audit logs when the log_raw option is enabled, affecting HashiCorp Vault deployments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-0831?
CVE-2024-0831 is a medium-severity vulnerability in Hashicorp Vault, published on 1 Feb 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.
Weakness: CWE-532
Which versions are affected by CVE-2024-0831?
4 open source packages ship an affected version, including github.com/hashicorp/vault and vault. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/vault Go | From 1.15.0 | 1.15.5 |
github.com/hashicorp/vault Go | From 1.15.0 | 1.15.5 |
github.com/hashicorp/vault Go | From 1.15.0 | 1.15.5 |
vault Bitnami | From 1.15.0 | 1.15.5 |
Products include Hashicorp Vault.
How do I fix CVE-2024-0831?
Upgrade github.com/hashicorp/vault to 1.15.5 or later.
Is CVE-2024-0831 being exploited?
There is no known exploitation of CVE-2024-0831 in the wild and no public exploit code.
Other vulnerabilities in Hashicorp Vault
Sources
Also known as BIT-vault-2024-0831, GHSA-vgh3-mwxq-rcp8, GO-2024-2511.