Vulnerability-Lookup

WID-SEC-W-2025-2665

Vulnerability from csaf_certbund - Published: 2025-11-23 23:00 - Updated: 2025-11-23 23:00

Summary

Hashicorp Terraform (Enterprise, Vault Provider): Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Terraform ist ein Infrastruktur-als-Code-Tool.

Angriff

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Hashicorp Terraform ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten zu manipulieren.

Betroffene Betriebssysteme

- Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Terraform ist ein Infrastruktur-als-Code-Tool.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Hashicorp Terraform ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2665 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2665.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2665 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2665"
      },
      {
        "category": "external",
        "summary": "Hashicorp Security Advisory HCSEC-2025-33 vom 2025-11-23",
        "url": "https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822"
      },
      {
        "category": "external",
        "summary": "Hashicorp Security Advisory HCSEC-2025-34 vom 2025-11-23",
        "url": "https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821"
      }
    ],
    "source_lang": "en-US",
    "title": "Hashicorp Terraform (Enterprise, Vault Provider): Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-11-23T23:00:00.000+00:00",
      "generator": {
        "date": "2025-11-24T08:52:38.361+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2025-2665",
      "initial_release_date": "2025-11-23T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-11-23T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Enterprise \u003c1.1.1",
                "product": {
                  "name": "Hashicorp Terraform Enterprise \u003c1.1.1",
                  "product_id": "T048845"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise 1.1.1",
                "product": {
                  "name": "Hashicorp Terraform Enterprise 1.1.1",
                  "product_id": "T048845-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hashicorp:terraform:enterprise__1.1.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Enterprise \u003c1.0.3",
                "product": {
                  "name": "Hashicorp Terraform Enterprise \u003c1.0.3",
                  "product_id": "T048846"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise 1.0.3",
                "product": {
                  "name": "Hashicorp Terraform Enterprise 1.0.3",
                  "product_id": "T048846-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hashicorp:terraform:enterprise__1.0.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Vault Provider \u003cv5.5.0",
                "product": {
                  "name": "Hashicorp Terraform Vault Provider \u003cv5.5.0",
                  "product_id": "T048851"
                }
              },
              {
                "category": "product_version",
                "name": "Vault Provider v5.5.0",
                "product": {
                  "name": "Hashicorp Terraform Vault Provider v5.5.0",
                  "product_id": "T048851-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hashicorp:terraform:v5.5.0::vault_provider"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Terraform"
          }
        ],
        "category": "vendor",
        "name": "Hashicorp"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13357",
      "product_status": {
        "known_affected": [
          "T048851"
        ]
      },
      "release_date": "2025-11-23T23:00:00.000+00:00",
      "title": "CVE-2025-13357"
    },
    {
      "cve": "CVE-2025-13432",
      "product_status": {
        "known_affected": [
          "T048846",
          "T048845"
        ]
      },
      "release_date": "2025-11-23T23:00:00.000+00:00",
      "title": "CVE-2025-13432"
    }
  ]
}

CVE-2025-13357 (GCVE-0-2025-13357)

Vulnerability from cvelistv5 – Published: 2025-11-21 15:02 – Updated: 2025-11-24 18:00

Title

Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method

Summary

Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-1188 - Initialization of a Resource with an Insecure Default

Assigner

HashiCorp

References

URL

Tags

https://discuss.hashicorp.com/t/hcsec-2025-33-vau…

Impacted products

	Vendor	Product	Version
	HashiCorp	Tooling	Affected: 4.2.0 , < 5.5.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13357",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-21T15:30:52.630287Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-24T18:00:33.469Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Tooling",
          "repo": "https://github.com/hashicorp/terraform-provider-vault",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "5.5.0",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eVault\u2019s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.\u003c/p\u003e\u003cbr/\u003e"
            }
          ],
          "value": "Vault\u2019s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115: Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Initialization of a Resource with an Insecure Default",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-21T15:13:57.083Z",
        "orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
        "shortName": "HashiCorp"
      },
      "references": [
        {
          "url": "https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822"
        }
      ],
      "source": {
        "advisory": "HCSEC-2025-33",
        "discovery": "EXTERNAL"
      },
      "title": "Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
    "assignerShortName": "HashiCorp",
    "cveId": "CVE-2025-13357",
    "datePublished": "2025-11-21T15:02:27.081Z",
    "dateReserved": "2025-11-18T15:38:23.306Z",
    "dateUpdated": "2025-11-24T18:00:33.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-13432 (GCVE-0-2025-13432)

Vulnerability from cvelistv5 – Published: 2025-11-21 14:20 – Updated: 2025-11-21 15:13

Title

Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access

Summary

Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

HashiCorp

References

URL

Tags

https://discuss.hashicorp.com/t/hcsec-2025-34-ter…

Impacted products

	Vendor	Product	Version
	HashiCorp	Terraform Enterprise	Affected: 1.0.0 , < 1.1.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13432",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-21T15:13:04.443052Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-21T15:13:18.518Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Terraform Enterprise",
          "vendor": "HashiCorp",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.0.3",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1.1.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTerraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.\u003c/p\u003e\u003cbr/\u003e"
            }
          ],
          "value": "Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-176",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-176: Configuration/Environment Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-21T14:34:33.720Z",
        "orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
        "shortName": "HashiCorp"
      },
      "references": [
        {
          "url": "https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821"
        }
      ],
      "source": {
        "advisory": "HCSEC-2025-34",
        "discovery": "EXTERNAL"
      },
      "title": "Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
    "assignerShortName": "HashiCorp",
    "cveId": "CVE-2025-13432",
    "datePublished": "2025-11-21T14:20:53.921Z",
    "dateReserved": "2025-11-19T16:38:34.330Z",
    "dateUpdated": "2025-11-21T15:13:18.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2025-2665

CVE-2025-13357 (GCVE-0-2025-13357)

CVE-2025-13432 (GCVE-0-2025-13432)

Tags

Sightings

Nomenclature