Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-8260
CVE-2024-8260:
Datadog Agent vulnerability analysis and mitigation
Overview
A SMB force-authentication vulnerability (CVE-2024-8260) was discovered in all versions of Open Policy Agent (OPA) for Windows prior to v0.68.0. The vulnerability was discovered on June 19, 2024, and disclosed to Styra on August 6, 2024. The vulnerability affects both the OPA CLI (Community and Enterprise editions) and the OPA Go SDK running on Windows systems (Tenable Advisory).
Technical details
The vulnerability exists due to improper input validation, which allows a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library's functions. The vulnerability affects multiple OPA CLI commands including 'opa eval -d', 'opa eval --bundle', and 'opa run -s', as well as OPA Go package functions like 'Rego.Load(, nil)' and 'Rego.LoadBundle()'. The vulnerability has been assigned a CVSSv3 base score of 6.1 (Medium) with a vector of AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L (Tenable Advisory).
Impact
A successful exploit of this vulnerability can lead to unauthorized access by leaking the Net-NTLMv2 hash of the user currently logged into the Windows device running the OPA application, provided the victim can initiate outbound Server Message Block (SMB) traffic over port 445. Post-exploitation, the attacker can either relay authentication to other systems that support NTLMv2 or perform offline cracking to extract the password (Tenable Advisory).
Mitigation and workarounds
The recommended solution is to upgrade to OPA version v0.68.0 or later, which includes a fix for this vulnerability. The fix adds checks in all the affected symbols of the loader.go package that raise an error if a UNC is provided (Tenable Advisory, OPA Release).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management