title: Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
description: Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.
problem types: CWE-295 Improper Certificate Validation
affected:
{
vendor: HashiCorp
product: Boundary
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
repo: https://github.com/hashicorp/boundary
versions:
status: affected, version: 0.8.0, lessThan: 0.15.0, versionType: semver
defaultStatus: unaffected
}
{
vendor: HashiCorp
product: Boundary Enterprise
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
versions:
status: affected, version: 0.8.0, lessThan: 0.15.0, versionType: semver
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
]