CVE-2023-37268: User login confusion with SSO in warpgate
Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit 8173f6512a and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
warpgateto a version that resolves this vulnerability.Patch 8173f6512a - Upgrade
Upgrade
warpgateto a version that resolves this vulnerability.Fixed in 0.7.3 - Configuration
For any user account that does not have a second factor enabled, require users to use a second factor in authentication when upgrading is not possible.
warpgate authentication Second factor enabled = required - Compensating control
If upgrade cannot be performed, enforce second-factor authentication for users (to mitigate the user login confusion with SSO where an attacker may authenticate as another user).
Event History
Frequently Asked Questions
What is CVE-2023-37268?
CVE-2023-37268 is a vulnerability in Warpgate, an SSH, HTTPS, and MySQL bastion host for Linux, that allows an attacker to authenticate as another user when logging in as a user with single sign-on (SSO) enabled.
How can an attacker exploit CVE-2023-37268?
An attacker can exploit CVE-2023-37268 by logging in as a user with SSO enabled and then authenticating as another user.
What is the severity of CVE-2023-37268?
CVE-2023-37268 has a severity rating of 8.8 (high).
Which version of Warpgate is affected by CVE-2023-37268?
Warpgate version 0.7.2 is affected by CVE-2023-37268.
How can I fix CVE-2023-37268?
To fix CVE-2023-37268, it is recommended to upgrade to a version of Warpgate that includes the fix for the vulnerability.