CVE-2024-12289 Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
Attackers can cause premature termination of the Boundary server by sending HTTP requests during its brief initialization phase.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-12289?
CVE-2024-12289 is a medium-severity denial of service vulnerability in HashiCorp Boundary, published on 12 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process.
This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.
Which versions are affected by CVE-2024-12289?
3 open source packages ship an affected version, including github.com/hashicorp/boundary. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/boundary Go | All versions | 0.18.2 |
github.com/hashicorp/boundary Go | All versions | 0.18.2 |
github.com/hashicorp/boundary Go | All versions | 0.18.2 |
Products include Hashicorp Boundary.
How do I fix CVE-2024-12289?
Upgrade github.com/hashicorp/boundary to 0.18.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-12289 being exploited?
There is no known exploitation of CVE-2024-12289 in the wild and no public exploit code.
Other vulnerabilities in HashiCorp Boundary
- CVE-2022-36130 Privilege escalation in n/a
- CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
- CVE-2022-36182 Hashicorp Boundary vulnerable to clickjacking
- CVE-2023-0690 Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured
Sources
Also known as GHSA-xx83-cxmq-x89m, GO-2024-3335.