GHSA-w7wm-2425-7p2h

Suggest an improvement
Source
https://github.com/advisories/GHSA-w7wm-2425-7p2h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w7wm-2425-7p2h/GHSA-w7wm-2425-7p2h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w7wm-2425-7p2h
Aliases
Published
2025-02-04T21:23:48Z
Modified
2025-02-06T18:04:37Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS Calculator
Summary
MarbleRun unauthenticated recovery allows Coordinator impersonation
Details

Impact

During recovery, a Coordinator only verifies that a given recovery key decrypts the sealed state, not if this key was provided by a party with access to one of the recovery keys defined in the manifest. This allows an attacker to manually craft a sealed state using their own recovery keys, and a manifest that does not match the rest of the state.

If network traffic is redirected from the legitimate coordinator to the attacker's Coordinator, a remote party is susceptible to impersonation if they verify the Coordinator without comparing the root certificate of the Coordinator against a trusted reference.

Under these circumstances, an attacker can trick a remote party into trusting the malicious Coordinator by presenting a manifest that does not match the actual state of the deployment.

This issue does not affect the following:

  • secrets and state of the legitimate Coordinator instances
  • integrity of workloads
  • certificates chaining back to the legitimate Coordinator root certificate

Patches

The issue has been patched in <code>v1.7.0</code>.

Workarounds

Connections that purely authenticate based on a known Coordinator's root certificate, e.g. the one retrieved when using the marblerun manifest set CLI command, are not affected.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-285"
    ],
    "github_reviewed_at": "2025-02-04T21:23:48Z",
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

Go / github.com/edgelesssys/marblerun

Package

Name
github.com/edgelesssys/marblerun
View open source insights on deps.dev
Purl
pkg:golang/github.com/edgelesssys/marblerun

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w7wm-2425-7p2h/GHSA-w7wm-2425-7p2h.json"