Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-0665

CVE-2023-0665: HashiCorp Vault's PKI mount vulnerable to denial of service

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-0665
GHSA ID
GHSA-hwc3-3qh6-r4gg
EPSS Score
0.25209%
CWE
CWE-285
Published
3/30/2023
Updated
5/26/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/hashicorp/vaultgo< 1.11.91.11.9
github.com/hashicorp/vaultgo>= 1.12.0, < 1.12.51.12.5
github.com/hashicorp/vaultgo>= 1.13.0, < 1.13.11.13.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unauthenticated endpoints (/issuer/:ref/{json,der,pem}) that handle issuer metadata operations. These functions correspond to the documented attack vectors:-

  1. pathDeleteIssuer matches the 'remove an issuer' capability described
  2. pathModifyIssuer aligns with 'modify issuer metadata' operations While exact code isn't available, Vault's PKI implementation structure and HashiCorp's bulletin explicitly reference these endpoint types as vulnerable. The CWE-285 mapping confirms authorization flaws in these write operations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**s*i*orp V*ult's PKI mount issu*r *n*points *i* not *orr**tly *ut*oriz* ****ss to r*mov* *n issu*r or mo*i*y issu*r m*t***t*, pot*nti*lly r*sultin* in **ni*l o* s*rvi** o* t** PKI mount. T*is *u* *i* not *****t pu*li* or priv*t* k*y m*t*ri*l, trust

Reasoning

T** vuln*r**ility st*ms *rom un*ut**nti**t** *n*points (/issu*r/:r**/{json,**r,p*m}) t**t **n*l* issu*r m*t***t* op*r*tions. T**s* *un*tions *orr*spon* to t** *o*um*nt** *tt**k v**tors:- *. p*t***l*t*Issu*r m*t***s t** 'r*mov* *n issu*r' **p**ility