CVE-2020-24359
📋 TL;DR
HashiCorp vault-ssh-helper versions up to 0.1.6 incorrectly accept Vault-issued SSH OTPs for an entire subnet rather than a specific IP address, allowing attackers to use OTPs intended for one host to authenticate to any host in the same subnet. This affects organizations using vault-ssh-helper for SSH authentication with Vault OTPs.
💻 Affected Systems
- HashiCorp vault-ssh-helper
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with a valid OTP for any host in a subnet could gain unauthorized SSH access to all hosts in that subnet, potentially leading to lateral movement and full network compromise.
Likely Case
Unauthorized SSH access to multiple hosts within the same subnet, enabling privilege escalation and data exfiltration.
If Mitigated
Limited to isolated network segments with strict access controls, reducing lateral movement potential.
🎯 Exploit Status
Exploitation requires obtaining a valid OTP for any host in the target subnet, which could be intercepted or obtained through other means.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.2.0
Vendor Advisory: https://github.com/hashicorp/vault-ssh-helper/blob/master/CHANGELOG.md#020-august-19-2020
Restart Required: Yes
Instructions:
1. Download vault-ssh-helper version 0.2.0 or later from the official releases page. 2. Replace the existing binary with the new version. 3. Restart the vault-ssh-helper service on all affected hosts.
🔧 Temporary Workarounds
Network segmentation
allIsolate hosts into smaller subnets to limit the scope of potential OTP misuse.
Restrict SSH access
linuxUse firewall rules to limit SSH connections to trusted IP addresses only.
iptables -A INPUT -p tcp --dport 22 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to minimize subnet sizes.
- Monitor SSH authentication logs for unusual patterns or OTP reuse across hosts.
🔍 How to Verify
Check if Vulnerable:
Check the vault-ssh-helper version: vault-ssh-helper --version. If version is 0.1.6 or earlier, the system is vulnerable.Check Version:
vault-ssh-helper --versionVerify Fix Applied:
After updating, verify the version is 0.2.0 or later and test SSH authentication with OTPs to ensure they are validated against specific IP addresses.📡 Detection & Monitoring
Log Indicators:
- Multiple SSH authentication attempts from the same OTP across different IPs in a subnet
- SSH logins from unexpected IPs using valid OTPs
Network Indicators:
- Unusual SSH traffic patterns between hosts in the same subnet
SIEM Query:
source="ssh_logs" AND ("OTP" OR "vault-ssh-helper") AND (duplicate_otp OR multiple_hosts)