Vulnerability · Published Nov 8, 2023 · Assigned by GitHub_M

CVE-2023-45140Group-based JIT MFA bypass on scp and sftp in The Bastion

Medium 4.8

In plain English

A medium-severity missing authentication in the-bastion from ovh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.4%top 67.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.

Affected products (as reported)

Vendor	Product	Versions
ovh	the-bastion	>= 3.0.0, <= 3.14.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x x_refsource_CONFIRM
https://github.com/ovh/the-bastion/releases/tag/v3.14.15 x_refsource_MISC