CVE-2020-16250: HashiCorp Vault AWS IAM Auth Method Authentication Bypass
Summary
CVE-2020-16250: HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Affects vault across 4 version ranges.
>= 0.7.1, < 1.2.5
>= 1.3.0, < 1.3.8
>= 1.4.0, < 1.4.4
>= 1.5.0, < 1.5.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-16250 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is an open-source tool designed for securely storing and accessing secrets. It provides a centralized solution for managing sensitive information such as API keys, passwords, and certificates. Vault offers various authentication methods, including the AWS IAM auth method, which allows users to authenticate using their AWS Identity and Access Management (IAM) credentials. This vulnerability affects versions 0.7.1 and newer of HashiCorp Vault and Vault Enterprise when configured with the AWS IAM auth method.
Vulnerability Detail
The vulnerability (CVE-2020-16250) in HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when using the AWS IAM auth method, may lead to authentication bypass. An attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive information stored in Vault. The issue has been fixed in versions 1.2.5, 1.3.8, 1.4.4, and 1.5.1 of Vault and Vault Enterprise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.7.1, < 1.2.51.2.5 -
>= 1.3.0, < 1.3.81.3.8 -
>= 1.4.0, < 1.4.41.4.4 -
>= 1.5.0, < 1.5.11.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to a fixed version as soon as possible to mitigate the risk of authentication bypass.
Conclusion
The authentication bypass vulnerability in HashiCorp Vault and Vault Enterprise poses a significant risk to the security of sensitive information. It is crucial to upgrade to a fixed version and follow recommended security practices to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for vault →
FAQ
HashiCorp Vault is an open-source tool for securely storing and accessing secrets. It provides a centralized solution for managing sensitive information such as API keys, passwords, and certificates.
The AWS IAM auth method in Vault allows users to authenticate using their AWS Identity and Access Management (IAM) credentials. It provides a seamless integration with AWS services and enables fine-grained access control.
The authentication bypass vulnerability in HashiCorp Vault occurs when using the AWS IAM auth method. It allows an attacker to bypass authentication and gain unauthorized access to sensitive information stored in Vault.
Versions 0.7.1 and newer of HashiCorp Vault and Vault Enterprise are affected by this vulnerability when configured with the AWS IAM auth method.
To fix this vulnerability, upgrade to a fixed version of HashiCorp Vault or Vault Enterprise (1.2.5, 1.3.8, 1.4.4, or 1.5.1). Ensure that the AWS IAM auth method is properly configured and follow best practices for securing Vault installations.
Related vulnerabilities
Recent vulnerabilities recorded for vault.
