CVE-2021-43998 : Security Advisory and Response
Learn about CVE-2021-43998 affecting HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4, leading to incorrect policy enforcement. Mitigation steps and upgrade to versions 1.7.6, 1.8.5, or 1.9.0.
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.
Understanding CVE-2021-43998
HashiCorp Vault and Vault Enterprise versions 0.11.0 up to 1.7.5 and 1.8.4 were affected by a vulnerability related to templated ACL policies.
What is CVE-2021-43998?
The vulnerability in HashiCorp Vault and Vault Enterprise versions 0.11.0 up to 1.7.5 and 1.8.4 allowed for incorrect policy enforcement due to templated ACL policies always matching the first-created entity alias in the presence of multiple entity aliases for a specific entity and mount combination.
The Impact of CVE-2021-43998
The vulnerability could lead to misconfigured access control policies and potential security breaches in systems leveraging HashiCorp Vault and Vault Enterprise versions 0.11.0 up to 1.7.5 and 1.8.4.
Technical Details of CVE-2021-43998
The technical aspects of the CVE include:
Vulnerability Description
- HashiCorp Vault and Vault Enterprise versions 0.11.0 up to 1.7.5 and 1.8.4 were affected
- Templated ACL policies would incorrectly match the first-created entity alias
Affected Systems and Versions
- Versions 0.11.0 up to 1.7.5 and 1.8.4
Exploitation Mechanism
- Multiple entity aliases for a specified entity and mount combination could lead to incorrect policy enforcement
Mitigation and Prevention
Steps to address and prevent the vulnerability:
Immediate Steps to Take
- Upgrade to Vault and Vault Enterprise versions 1.7.6, 1.8.5, or 1.9.0
- Review and adjust ACL policies to ensure correct enforcement
Long-Term Security Practices
- Regularly review access control configurations
- Monitor for unexpected policy matches and system behavior
Patching and Updates
- Apply patches and updates provided in versions 1.7.6, 1.8.5, or 1.9.0