CVE-2020-16250
vault: Hashicorp Vault AWS IAM Integration Authentication Bypass
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
HashiCorp Vault y Vault Enterprise versiones 0.7.1 y posteriores, cuando son configuradas con el método de autenticación AWS IAM, pueden ser vulnerables a una omisión de autenticación. Corregido en 1.2.5, 1.3.8, 1.4.4 y 1.5.1..
A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM identities and roles may be manipulated and bypass authentication.
HashiCorp Vault's AWS IAM authentication method can be bypassed by sending a serialized request to the STS AssumeRoleWithWebIdentity method as part of the authentication flow. The request triggers a JSON encoded response from the STS server, which can contain a fully-attacker controlled fake GetCallerIdentityResponse as part of its body. As the Vault response parser ignores non-xml content before and after the malicious response, this can be used to spoof arbitrary AWS identities and roles.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-07-31 CVE Reserved
- 2020-08-26 CVE Published
- 2024-06-30 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-290: Authentication Bypass by Spoofing
- CWE-345: Insufficient Verification of Data Authenticity
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.html | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151 | 2023-08-29 | |
| https://www.hashicorp.com/blog/category/vault | 2023-08-29 | |
| https://access.redhat.com/security/cve/CVE-2020-16250 | 2023-06-21 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2167337 | 2023-06-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 0.7.1 < 1.2.5 Search vendor "Hashicorp" for product "Vault" and version " >= 0.7.1 < 1.2.5" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 0.7.1 < 1.2.5 Search vendor "Hashicorp" for product "Vault" and version " >= 0.7.1 < 1.2.5" | enterprise |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.3.0 < 1.3.8 Search vendor "Hashicorp" for product "Vault" and version " >= 1.3.0 < 1.3.8" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.3.0 < 1.3.8 Search vendor "Hashicorp" for product "Vault" and version " >= 1.3.0 < 1.3.8" | enterprise |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.4.0 < 1.4.4 Search vendor "Hashicorp" for product "Vault" and version " >= 1.4.0 < 1.4.4" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.4.0 < 1.4.4 Search vendor "Hashicorp" for product "Vault" and version " >= 1.4.0 < 1.4.4" | enterprise |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.5.0 < 1.5.1 Search vendor "Hashicorp" for product "Vault" and version " >= 1.5.0 < 1.5.1" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.5.0 < 1.5.1 Search vendor "Hashicorp" for product "Vault" and version " >= 1.5.0 < 1.5.1" | enterprise |
Affected
| ||||||