GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-7594 (GCVE-0-2024-7594)

Vulnerability from cvelistv5 – Published: 2024-09-26 19:52 – Updated: 2025-01-10 13:06
VLAI
Title
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default
Summary
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-26 20:24 UTC
CWE
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
Impacted products
Vendor Product Version CPE status
HashiCorp Vault Affected: 1.7.7 , < 1.17.6 (semver)
guessed Create a notification for this product.
HashiCorp Vault Enterprise Affected: 1.7.7 , < 1.17.6 (semver)
guessed Create a notification for this product.
hashicorp vault_enterprise Affected: 1.7.7 , < 1.17.6 (semver)
Affected: 1.16.9
Affected: 1.15.14
    cpe:2.3:a:hashicorp:vault_enterprise:*:*:*:*:*:*:*:*
Create a notification for this product.
hashicorp vault_community_edition Affected: 1.7.7 , < 1.17.6 (semver)
    cpe:2.3:a:hashicorp:vault_community_edition:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:hashicorp:vault_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "vault_enterprise",
            "vendor": "hashicorp",
            "versions": [
              {
                "lessThan": "1.17.6",
                "status": "affected",
                "version": "1.7.7",
                "versionType": "semver"
              },
              {
                "status": "affected",
                "version": "1.16.9"
              },
              {
                "status": "affected",
                "version": "1.15.14"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:hashicorp:vault_community_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "vault_community_edition",
            "vendor": "hashicorp",
            "versions": [
              {
                "lessThan": "1.17.6",
                "status": "affected",
                "version": "1.7.7",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7594",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T20:24:40.797176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:29:58.984Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-10T13:06:49.543Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250110-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Vault",
          "repo": "https://github.com/hashicorp/vault",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "1.17.6",
              "status": "affected",
              "version": "1.7.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Vault Enterprise",
          "repo": "https://github.com/hashicorp/vault",
          "vendor": "HashiCorp",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.16.10",
                  "status": "unaffected"
                },
                {
                  "at": "1.15.15",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1.17.6",
              "status": "affected",
              "version": "1.7.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eVault\u2019s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault\u2019s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.\u003c/p\u003e\u003cbr/\u003e"
            }
          ],
          "value": "Vault\u2019s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault\u2019s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-26T19:56:15.934Z",
        "orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
        "shortName": "HashiCorp"
      },
      "references": [
        {
          "url": "https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251"
        }
      ],
      "source": {
        "advisory": "HCSEC-2024-20",
        "discovery": "EXTERNAL"
      },
      "title": "Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
    "assignerShortName": "HashiCorp",
    "cveId": "CVE-2024-7594",
    "datePublished": "2024-09-26T19:52:55.652Z",
    "dateReserved": "2024-08-07T17:46:31.343Z",
    "dateUpdated": "2025-01-10T13:06:49.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-7594",
      "date": "2026-09-14",
      "epss": "0.00269",
      "percentile": "0.19011"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Vault\\u2019s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault\\u2019s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.\"}, {\"lang\": \"es\", \"value\": \"El motor de secretos SSH de Vault no requer\\u00eda que la lista valid_principals contuviera un valor de manera predeterminada. Si los campos valid_principals y default_user de la configuraci\\u00f3n del motor de secretos SSH no est\\u00e1n configurados, un certificado SSH solicitado por un usuario autorizado al motor de secretos SSH de Vault podr\\u00eda usarse para autenticarse como cualquier usuario en el host. Se corrigi\\u00f3 en Vault Community Edition 1.17.6 y en Vault Enterprise 1.17.6, 1.16.10 y 1.15.15.\"}]",
      "id": "CVE-2024-7594",
      "lastModified": "2025-01-10T13:15:10.303",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@hashicorp.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 5.9}]}",
      "published": "2024-09-26T20:15:07.687",
      "references": "[{\"url\": \"https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251\", \"source\": \"security@hashicorp.com\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20250110-0007/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@hashicorp.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security@hashicorp.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-732\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-7594\",\"sourceIdentifier\":\"security@hashicorp.com\",\"published\":\"2024-09-26T20:15:07.687\",\"lastModified\":\"2026-06-17T08:20:31.020\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vault\u2019s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault\u2019s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.\"},{\"lang\":\"es\",\"value\":\"El motor de secretos SSH de Vault no requer\u00eda que la lista valid_principals contuviera un valor de manera predeterminada. Si los campos valid_principals y default_user de la configuraci\u00f3n del motor de secretos SSH no est\u00e1n configurados, un certificado SSH solicitado por un usuario autorizado al motor de secretos SSH de Vault podr\u00eda usarse para autenticarse como cualquier usuario en el host. Se corrigi\u00f3 en Vault Community Edition 1.17.6 y en Vault Enterprise 1.17.6, 1.16.10 y 1.15.15.\"}],\"affected\":[{\"source\":\"security@hashicorp.com\",\"affectedData\":[{\"vendor\":\"HashiCorp\",\"product\":\"Vault\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"64 bit\",\"32 bit\",\"x86\",\"ARM\",\"MacOS\",\"Windows\",\"Linux\"],\"repo\":\"https://github.com/hashicorp/vault\",\"versions\":[{\"version\":\"1.7.7\",\"lessThan\":\"1.17.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"HashiCorp\",\"product\":\"Vault Enterprise\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"64 bit\",\"32 bit\",\"x86\",\"ARM\",\"MacOS\",\"Windows\",\"Linux\"],\"repo\":\"https://github.com/hashicorp/vault\",\"versions\":[{\"version\":\"1.7.7\",\"lessThan\":\"1.17.6\",\"versionType\":\"semver\",\"status\":\"affected\",\"changes\":[{\"at\":\"1.16.10\",\"status\":\"unaffected\"},{\"at\":\"1.15.15\",\"status\":\"unaffected\"}]}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"hashicorp\",\"product\":\"vault_enterprise\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:hashicorp:vault_enterprise:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"1.7.7\",\"lessThan\":\"1.17.6\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.16.9\",\"status\":\"affected\"},{\"version\":\"1.15.14\",\"status\":\"affected\"}]},{\"vendor\":\"hashicorp\",\"product\":\"vault_community_edition\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:hashicorp:vault_community_edition:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"1.7.7\",\"lessThan\":\"1.17.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@hashicorp.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-26T20:24:40.797176Z\",\"id\":\"CVE-2024-7594\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@hashicorp.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"1.7.7\",\"versionEndExcluding\":\"1.15.15\",\"matchCriteriaId\":\"249707D4-F472-4111-AD3B-87BB8FBAC1A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"1.7.7\",\"versionEndExcluding\":\"1.17.6\",\"matchCriteriaId\":\"083F9267-6753-4849-91F5-5B07CF366433\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"1.16.0\",\"versionEndExcluding\":\"1.16.10\",\"matchCriteriaId\":\"8E3ED5F4-F345-4626-8073-56C6EDC4E358\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"1.17.0\",\"versionEndExcluding\":\"1.17.6\",\"matchCriteriaId\":\"1AD9A7FA-38F6-48DE-9158-84D4B5AA2F7D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.0.2\",\"matchCriteriaId\":\"4040D58A-447B-429B-8F78-77166B5E5ADA\"}]}]}],\"references\":[{\"url\":\"https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251\",\"source\":\"security@hashicorp.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20250110-0007/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-26T00:03:04+00:00",
      "cve": "CVE-2024-7594",
      "id": "CVE-2024-7594",
      "initial_release_date": "2024-09-26T20:15:07.687000+00:00",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "26",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "hashicorp/vault: Vault SSH secrets engine configuration did not restrict valid principals by default",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-7594.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-22T16:50:30Z",
      "cve": "CVE-2024-7594",
      "id": "CVE-2024-7594",
      "initial_release_date": "2024-11-02T04:03:16Z",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-7594",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-7594.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://security.netapp.com/advisory/ntap-20250110-0007/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-01-10T13:06:49.543Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-7594\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-26T20:24:40.797176Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:hashicorp:vault_enterprise:*:*:*:*:*:*:*:*\"], \"vendor\": \"hashicorp\", \"product\": \"vault_enterprise\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.7.7\", \"lessThan\": \"1.17.6\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.16.9\"}, {\"status\": \"affected\", \"version\": \"1.15.14\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:hashicorp:vault_community_edition:*:*:*:*:*:*:*:*\"], \"vendor\": \"hashicorp\", \"product\": \"vault_community_edition\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.7.7\", \"lessThan\": \"1.17.6\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-26T20:27:27.031Z\"}}], \"cna\": {\"title\": \"Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default\", \"source\": {\"advisory\": \"HCSEC-2024-20\", \"discovery\": \"EXTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-1\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/hashicorp/vault\", \"vendor\": \"HashiCorp\", \"product\": \"Vault\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.7.7\", \"lessThan\": \"1.17.6\", \"versionType\": \"semver\"}], \"platforms\": [\"64 bit\", \"32 bit\", \"x86\", \"ARM\", \"MacOS\", \"Windows\", \"Linux\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://github.com/hashicorp/vault\", \"vendor\": \"HashiCorp\", \"product\": \"Vault Enterprise\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"1.16.10\", \"status\": \"unaffected\"}, {\"at\": \"1.15.15\", \"status\": \"unaffected\"}], \"version\": \"1.7.7\", \"lessThan\": \"1.17.6\", \"versionType\": \"semver\"}], \"platforms\": [\"64 bit\", \"32 bit\", \"x86\", \"ARM\", \"MacOS\", \"Windows\", \"Linux\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Vault\\u2019s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault\\u2019s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eVault\\u2019s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault\\u2019s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.\u003c/p\u003e\u003cbr/\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-732\", \"description\": \"CWE-732: Incorrect Permission Assignment for Critical Resource\"}]}], \"providerMetadata\": {\"orgId\": \"67fedba0-ff2e-4543-ba5b-aa93e87718cc\", \"shortName\": \"HashiCorp\", \"dateUpdated\": \"2024-09-26T19:56:15.934Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-7594\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-10T13:06:49.543Z\", \"dateReserved\": \"2024-08-07T17:46:31.343Z\", \"assignerOrgId\": \"67fedba0-ff2e-4543-ba5b-aa93e87718cc\", \"datePublished\": \"2024-09-26T19:52:55.652Z\", \"assignerShortName\": \"HashiCorp\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.