High severity · published Feb 5, 2024
CVE-2024-1052
Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Boundary · HashiCorp
0.8.0 before 0.15.0 · source: vendor, NVD, CISA
BE
Boundary Enterprise · HashiCorp
0.8.0 before 0.15.0 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1052
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1052
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2024-02-boundary-vulnerable-to-session-hijacking-through-tls-certificate-tampering/62458
More from Boundary
9.9
CVE-2022-36130
HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege…
8.7
CVE-2026-13303
Boundary vulnerable to server-side request forgery in Vault credential store
7.5
CVE-2026-7776
Boundary Workers Vulnerable to Denial of Service During TLS Handshake
7.1
CVE-2023-0690
HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new…
6.1
CVE-2022-36182
Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to…