GHSA-w7wm-2425-7p2h: 
vulnerability analysis and mitigation

The vulnerability (GHSA-w7wm-2425-7p2h) affects MarbleRun versions prior to 1.7.0, discovered and disclosed on February 4, 2025. This high-severity vulnerability allows unauthenticated recovery that enables Coordinator impersonation. During recovery operations, the Coordinator only verifies if a given recovery key can decrypt the sealed state, without validating whether the key belongs to an authorized party defined in the manifest (GitHub Advisory).

The vulnerability has a CVSS v3.1 score of 7.1 (High) with the following characteristics: Network attack vector, Low attack complexity, No privileges required, User interaction required, Unchanged scope, Low confidentiality impact, High integrity impact, and No availability impact. The vulnerability is classified as CWE-285. The technical issue stems from the Coordinator's failure to verify if recovery keys match those defined in the manifest, allowing attackers to craft sealed states using unauthorized recovery keys (GitHub Advisory).

If an attacker successfully exploits this vulnerability by redirecting network traffic from a legitimate coordinator to a malicious one, they can impersonate the Coordinator when remote parties don't compare the root certificate against a trusted reference. The attacker can then present a manifest that doesn't match the actual deployment state. However, the vulnerability does not affect the secrets and state of legitimate Coordinator instances, workload integrity, or certificates chaining back to the legitimate Coordinator root certificate (GitHub Advisory).

The vulnerability has been patched in MarbleRun version 1.7.0. As a workaround, connections that authenticate based on a known Coordinator's root certificate (such as those using the marblerun manifest set CLI command) are not affected by this vulnerability. Users should update to version 1.7.0, noting that this update requires manual recovery of the Coordinator and access to recovery private keys matching the recovery public keys defined in the manifest (GitHub Release).