CVE-2024-9180 Vault Operators in Root Namespace May Elevate Their Privileges
Privileged Vault operators can escalate privileges to root policy via the identity endpoint, requiring an upgrade to secure the system.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-9180?
CVE-2024-9180 is a high-severity vulnerability in Hashicorp Vault, published on 10 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.
Weakness: CWE-266
Which versions are affected by CVE-2024-9180?
7 open source packages ship an affected version, including github.com/hashicorp/vault, openbao and vault. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/vault Go | All versions | 1.18.0 |
github.com/hashicorp/vault Go | All versions | 1.18.0 |
github.com/hashicorp/vault Go | All versions | 1.18.0 |
openbao Bitnami | All versions | 2.0.3 |
vault Bitnami | From 1.7.7 | 1.18.0 |
github.com/openbao/openbao Go | All versions | 2.0.3 |
1 more packages
github.com/openbao/openbao Go | All versions | 2.0.3 |
Products include Hashicorp Vault, Openbao Openbao.
How do I fix CVE-2024-9180?
Upgrade github.com/hashicorp/vault to 1.18.0 or later.
Is CVE-2024-9180 being exploited?
There is no known exploitation of CVE-2024-9180 in the wild and no public exploit code.
Other vulnerabilities in Hashicorp Vault
Sources
Also known as BIT-openbao-2024-9180, BIT-vault-2024-9180, GHSA-rr8j-7w34-xp5j, GO-2024-3191.