CVE-2024-1052
High
Description
Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.
SeverityHigh
CVSS8.0
Exploit probability—
ProductHashicorp Boundary
PublishedFeb 5, 2024
First seenFeb 5, 2024
Weakness typeCWE-295CWE-295
How to fix
Update
- hashicorp boundary0.15.0 or later
- github.com/hashicorp/boundary0.15.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hashicorp boundary | 0.8.0 ≤ v < 0.15.0 | 0.15.0 |
| github.com/hashicorp/boundaryGo | 0.8.0 ≤ v < 0.15.0 | 0.15.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.