CVE-2024-1052
📋 TL;DR
Boundary and Boundary Enterprise are vulnerable to session hijacking through TLS certificate tampering. Attackers with specific privileges can craft TLS certificates to hijack active sessions and access underlying services. This affects organizations using Boundary for secure remote access.
💻 Affected Systems
- Boundary
- Boundary Enterprise
📦 What is this software?
Boundary by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of remote access infrastructure, allowing attackers to access all connected backend systems and sensitive data through hijacked sessions.
Likely Case
Targeted session hijacking leading to unauthorized access to specific backend applications or systems accessible through Boundary.
If Mitigated
Limited impact due to proper privilege separation, certificate validation, and network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires multiple privilege levels and specific conditions, making it moderately complex.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.15.2
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2024-02-boundary-vulnerable-to-session-hijacking-through-tls-certificate-tampering/62458
Restart Required: Yes
Instructions:
1. Download Boundary version 0.15.2 or later. 2. Stop Boundary services. 3. Replace binary with patched version. 4. Restart Boundary services. 5. Verify successful upgrade.
🔧 Temporary Workarounds
Restrict Session Enumeration
allLimit which users can enumerate active sessions to reduce attack surface.
boundary scopes update -scope-id=<scope_id> -authorized-actions=read
Implement Certificate Pinning
allUse certificate pinning to prevent TOFU token misuse.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Boundary infrastructure
- Enforce least privilege access controls and audit all session enumeration activities
🔍 How to Verify
Check if Vulnerable:
Check Boundary version: boundary versionCheck Version:
boundary versionVerify Fix Applied:
Verify version is 0.15.2 or later: boundary version | grep -E '0\.15\.[2-9]|0\.1[6-9]|1\.[0-9]'📡 Detection & Monitoring
Log Indicators:
- Multiple failed session authentication attempts
- Unusual session enumeration patterns
- Certificate validation errors
Network Indicators:
- Unexpected TLS certificate changes during active sessions
- Suspicious certificate authority modifications
SIEM Query:
source="boundary" AND (event="session_hijack" OR event="certificate_tampering")