Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2020-16250] Enter the Vault: Authentication Issues in HashiCorp Vault

projectzero.google | vulnerability | CVE-2020-16250 | #cloud | #aws | #authentication | #cve | #project-zero | #hashicorp-vault

Summary

In this blog post I'll discuss two vulnerabilities in HashiCorp Vault and its integration with Amazon Web Services (AWS) and Google Cloud Platform (GCP). These issues can lead to an authentication bypass in configurations that use the aws and gcp auth methods, and demonstrate the type of issues you can find in modern “cloud-native” software. Both vulnerabilities (CVE-2020-16250/16251) were addressed by HashiCorp and are fixed in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1 released in August.
CVE
CVE-2020-16250
Published
Collected

original ↗

Related coverage

blog · blog.trailofbits.com
Unexpected security footguns in Go's parsers
Unexpected behaviors in Go's JSON, XML, and YAML parsers let attackers bypass authentication, evade authorization, and exfiltrate data—seen in HashiCorp Vault's CVE-2020-16250 and real engagements.
vulnerability · projectdiscovery.io
How ConnectWise streamlined vulnerability detection with ProjectDiscovery
ConnectWise moved vulnerability scanning for 20,000+ AWS instances from Tenable Cloud to ProjectDiscovery, cutting scan time for 10,000 assets from two days to 15 minutes and retiring custom scripts.
vulnerability · projectzero.google
[CVE-2020-9802] JITSploitation I: A JIT Bug
This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
vulnerability · projectzero.google
[CVE-2020-9802] JITSploitation III: Subverting Control Flow
This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
vulnerability · projectzero.google
[CVE-2020-9802] JITSploitation II: Getting Read/Write
This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
vulnerability · projectzero.google
[CVE-2020-6831] Exploiting Android Messengers with WebRTC: Part 2
I started off by going through WebRTC bugs I had filed in the past to see if any had the potential to break ASLR. Even if a bug was fixed long ago, it is an indicator of where similar bugs could potentially be found. One such bug was CVE-2020-6831, which is an out-of-bounds read in usrsctp.
back