HashiCorp Vault/Vault Enterprise up to 1.18.0 API Endpoint failing open

Summaryinfo

A vulnerability classified as critical was found in HashiCorp Vault and Vault Enterprise up to 1.18.0. The affected element is an unknown function of the component API Endpoint. The manipulation results in failing open. This vulnerability was named CVE-2024-8185. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in HashiCorp Vault and Vault Enterprise up to 1.18.0. Affected is an unknown function of the component API Endpoint. The manipulation with an unknown input leads to a failing open vulnerability. CWE is classifying the issue as CWE-636. When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions. This is going to have an impact on availability. CVE summarizes:

Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself. This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.

The advisory is available at discuss.hashicorp.com. This vulnerability is traded as CVE-2024-8185 since 08/26/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 210710 (SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2024:3950-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.18.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210710). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• HashiCorp

Name

• Vault
• Vault Enterprise

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion