CVE-2021-43837: vault-cli Remote Code Execution in Hashicorp Vault
Summary
CVE-2021-43837: vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. Affects vault-cli across 2 version ranges.
< 3.0.0
< 3ba3955887fd6b7d4d646c8b260f21cebf5db852
Fixed in 3ba3955887fd6b7d4d646c8b260f21cebf5db852. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vault-cli is a configurable command-line interface tool and python library used to interact with Hashicorp Vault. It provides a convenient way to manage secrets and access control in a Vault instance. The tool allows rendering templated values, which can be useful for dynamically generating secret values. However, versions before 3.0.0 of vault-cli are vulnerable to a Remote Code Execution (RCE) risk when rendering Jinja2 templates. An attacker who can control a Jinja2 template rendered on a machine can execute arbitrary code, potentially compromising the system.
Vulnerability Detail
The vulnerability in vault-cli arises from its interpretation of secrets starting with the prefix !template! as Jinja2 templates. Jinja2 is a powerful templating engine but is not designed to safely render arbitrary templates. This allows an attacker to inject malicious code into a secret value, which is then executed when the template is rendered. This can lead to remote code execution and complete compromise of the system. Users who rely on vault-cli to manage secrets should be aware of this vulnerability and take appropriate measures to mitigate the risk.
How To Fix
Minimum fixed version
3ba3955887fd6b7d4d646c8b260f21cebf5db852
This is the first release that contains the fix.
pip install --upgrade "vault-cli==3ba3955887fd6b7d4d646c8b260f21cebf5db852"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of vault-cli is not immediately feasible, a workaround is available. Users can disable rendering of templated secrets by setting the environment variable VAULT_CLI_RENDER to false or using the --no-render flag when executing vault-cli commands. For example, vault-cli --no-render get-all. Another option is to add render: false to the vault-cli configuration YAML file. This will disable rendering of templated secrets and effectively remove the vulnerability.
Conclusion
The vulnerability in vault-cli versions before 3.0.0 poses a significant risk of remote code execution. Users of vault-cli should upgrade to the latest version to eliminate this vulnerability. If immediate upgrade is not possible, the workaround of disabling rendering of templated secrets can be used. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vault-cli →
FAQ
vault-cli is a command-line interface tool and python library used to interact with Hashicorp Vault. It provides a convenient way to manage secrets and access control in a Vault instance.
The vulnerability in vault-cli allows for remote code execution when rendering Jinja2 templates. An attacker who can control a template rendered on a machine can execute arbitrary code, potentially compromising the system.
The recommended fix is to upgrade to version 3.0.0 or later of vault-cli. This version removes the code related to interpreting templated secrets, eliminating the remote code execution risk.
Yes, if upgrading immediately is not possible, you can disable rendering of templated secrets by setting the VAULT_CLI_RENDER environment variable to false or using the --no-render flag when executing vault-cli commands.
Yes, you can find more information about this vulnerability in the official advisory database for PyPI: https://github.com/pypa/advisory-database/blob/main/vulns/vault-cli/PYSEC-2021-853.yaml
