CVE-2024-8365 Vault Leaks AppRole Client Tokens And Accessor in Audit Log
Attackers with audit log access can read plaintext client tokens and accessors due to missing HMAC masking, potentially leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-8365?
CVE-2024-8365 is a medium-severity vulnerability in Hashicorp Vault, published on 2 Sep 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.
Weakness: CWE-532
Which versions are affected by CVE-2024-8365?
4 open source packages ship an affected version, including github.com/hashicorp/vault and vault. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/vault Go | From 1.17.3 | 1.17.5 |
github.com/hashicorp/vault Go | From 1.17.3 | 1.17.5 |
github.com/hashicorp/vault Go | From 1.17.3 | 1.17.5 |
vault Bitnami | From 1.16.7 | 1.16.9, 1.17.5 |
Products include Hashicorp Vault.
How do I fix CVE-2024-8365?
Upgrade github.com/hashicorp/vault to 1.17.5 or later.
Is CVE-2024-8365 being exploited?
There is no known exploitation of CVE-2024-8365 in the wild and no public exploit code.
Other vulnerabilities in Hashicorp Vault
Sources
Also known as BIT-vault-2024-8365, GHSA-jjxf-26c9-77gm, GO-2024-3113.