CVE-2024-1052: Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
First published: Mon Feb 05 2024(Updated: )
Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.
Credit: security@hashicorp.com security@hashicorp.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/hashicorp/boundary | >=0.8.0<0.15.0 | 0.15.0 |
| HashiCorp Boundary | >=0.8.0<0.15.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1052?
CVE-2024-1052 is considered a critical vulnerability due to its potential for session hijacking.
How do I fix CVE-2024-1052?
To resolve CVE-2024-1052, upgrade to Boundary version 0.15.0 or later.
What types of systems are affected by CVE-2024-1052?
CVE-2024-1052 affects systems running HashiCorp Boundary versions between 0.8.0 and 0.15.0.
What is the impact of exploiting CVE-2024-1052?
Exploiting CVE-2024-1052 allows attackers to hijack user sessions, potentially compromising sensitive data.
Who can be targeted by CVE-2024-1052?
Attackers can target any user with active or pending sessions in affected instances of HashiCorp Boundary.
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/references
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vh73-q3rw-qx7w
- alias/CVE-2024-1052
- agent/software-canonical-lookup
- agent/event
- agent/author
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/nvd-api
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/tags
- agent/source
- package-manager/go
- vendor/hashicorp
- canonical/hashicorp boundary
- version/hashicorp boundary/0.8.0