GHSA-j3rq-4xjw-xg63 Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
Attackers can redirect CLI commands to a malicious Coordinator instance, bypassing manifest verification in MarbleRun.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-j3rq-4xjw-xg63?
GHSA-j3rq-4xjw-xg63 is a vulnerability in github.com/edgelesssys/marblerun, published on 4 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.
Patches
The issue has been patched in v1.4.0
Workarounds
Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.
Which versions are affected by GHSA-j3rq-4xjw-xg63?
3 open source packages ship an affected version, including github.com/edgelesssys/marblerun.
| Package | Affected | Fixed in |
|---|---|---|
github.com/edgelesssys/marblerun Go | All versions | 1.4.0 |
github.com/edgelesssys/marblerun Go | All versions | 1.4.0 |
github.com/edgelesssys/marblerun Go | All versions | 1.4.0 |
How do I fix GHSA-j3rq-4xjw-xg63?
Upgrade github.com/edgelesssys/marblerun to 1.4.0 or later.
Is GHSA-j3rq-4xjw-xg63 being exploited?
There is no known exploitation of GHSA-j3rq-4xjw-xg63 in the wild and no public exploit code.
Sources
Also known as GO-2023-2378.