CVE-2021-38553: HashiCorp Vault Integrated Storage File Permissions Vulnerability
Summary
CVE-2021-38553: HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Affects vault versions >= 1.4.0, < 1.8.0. Fixed in 1.8.0. How to fix ↓
Also tracked for
The same CVE-2021-38553 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is an open-source tool designed for securely storing and accessing secrets. It provides a centralized solution for managing sensitive information such as API keys, passwords, and certificates. Vault Enterprise is the commercial version of Vault, offering additional features and support. The Integrated Storage feature in Vault allows the storage of data in a local database file. This vulnerability affects versions 1.4.0 through 1.7.3 of Vault and Vault Enterprise. The vulnerability arises from the initialization of the underlying database file with excessively broad filesystem permissions.
Vulnerability Detail
The vulnerability (CVE-2021-38553) in HashiCorp Vault and Vault Enterprise versions 1.4.0 through 1.7.3 allows unauthorized access to the underlying database file associated with the Integrated Storage feature. By initializing the file with overly permissive filesystem permissions, an attacker with local access to the system could potentially read or modify the contents of the database file. This could lead to unauthorized disclosure or alteration of sensitive data stored within Vault. The issue has been addressed in Vault and Vault Enterprise version 1.8.0.
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The HashiCorp Vault Integrated Storage File Permissions Vulnerability (CVE-2021-38553) affects versions 1.4.0 through 1.7.3 of Vault and Vault Enterprise. Upgrading to version 1.8.0 is the recommended solution to address this vulnerability. For further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vault →
FAQ
HashiCorp Vault is an open-source tool for securely storing and accessing secrets. It provides a centralized solution for managing sensitive information such as API keys, passwords, and certificates.
The Integrated Storage feature in Vault allows the storage of data in a local database file. It provides a convenient way to persist secrets and other Vault data.
The vulnerability could allow an attacker with local access to the system to read or modify the contents of the underlying database file. This could lead to unauthorized disclosure or alteration of sensitive data stored within Vault.
Versions 1.4.0 through 1.7.3 of Vault and Vault Enterprise are affected by this vulnerability.
Until you can upgrade to version 1.8.0, it is recommended to restrict access to the underlying database file and closely monitor any unauthorized access attempts.
Related vulnerabilities
Recent vulnerabilities recorded for vault.
