Incorrect Permission Assignment for Critical Resource Affecting github.com/hashicorp/vault/builtin/logical/ssh package, versions >=1.7.7 <1.17.6


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.04% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-GOLANG-GITHUBCOMHASHICORPVAULTBUILTINLOGICALSSH-8102334
  • published27 Sept 2024
  • disclosed26 Sept 2024
  • creditJörn Heissler

Introduced: 26 Sep 2024

CVE-2024-7594  (opens in a new tab)
CWE-732  (opens in a new tab)

How to fix?

Upgrade github.com/hashicorp/vault/builtin/logical/ssh to version 1.17.6 or higher.

Overview

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to not requiring the valid_principals list to contain a value by default. An attacker could authenticate as any user on the host by using an SSH certificate requested by an authorized user to Vault’s SSH secrets engine.

Note: This can be exploited if the valid_principals and default_user fields of the SSH secrets engine configuration are not set.

CVSS Scores

version 4.0
version 3.1