CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

What is CVE-2024-1052?

CVE-2024-1052 is a high-severity authentication bypass vulnerability in HashiCorp Boundary, published on 5 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.

Weakness: CWE-295

Which versions are affected by CVE-2024-1052?

3 open source packages ship an affected version, including github.com/hashicorp/boundary. It affects 1 product.

Products include Hashicorp Boundary.

How do I fix CVE-2024-1052?

Upgrade github.com/hashicorp/boundary to 0.15.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-1052 being exploited?

There is no known exploitation of CVE-2024-1052 in the wild and no public exploit code.

Other vulnerabilities in HashiCorp Boundary

• CVE-2022-36130 Privilege escalation in n/a Critical 9.9
• CVE-2022-36182 Hashicorp Boundary vulnerable to clickjacking Medium 6.1
• CVE-2024-12289 Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service Medium 5.9
• CVE-2023-0690 Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vh73-q3rw-qx7w, GO-2024-2532.