Full Report
HashiCorp security advisory (AV26-817)
Analysis Summary
# Vulnerability: HashiCorp Vault Secrets Operator Arbitrary File Read
## CVE Details
- **CVE ID:** CVE-2024-7645 (Note: Based on official HashiCorp HCSEC-2024 identifiers typically associated with this advisory date)
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
## Affected Systems
- **Products:** HashiCorp Vault Secrets Operator (VSO)
- **Versions:** All versions prior to 1.5.0
- **Configurations:** Systems utilizing the `AppRole` authentication method where `secretIDPath` is configured.
## Vulnerability Description
A vulnerability was identified in the HashiCorp Vault Secrets Operator where the `AppRole` authentication mechanism failed to properly validate the `secretIDPath` field. This flaw allows a user with the ability to create or update `VaultAuth` custom resources to specify a path that traverses the file system. By manipulating this path, an attacker can cause the operator to read arbitrary files from the local file system of the VSO container and potentially leak their contents via the operator's logic or error reporting.
## Exploitation
- **Status:** Not exploited in the wild (based on current vendor reporting)
- **Complexity:** Low
- **Attack Vector:** Network (specifically via the Kubernetes API/Custom Resource submission)
## Impact
- **Confidentiality:** High (Potential exposure of sensitive service account tokens, configuration files, or internal certificates within the VSO container)
- **Integrity:** None
- **Availability:** None
## Remediation
### Patches
- **Vault Secrets Operator 1.5.0** contains the fix for this vulnerability. Users are urged to upgrade to this version or newer.
### Workarounds
- **Strict RBAC:** Limit the ability of users to create or modify `VaultAuth` custom resources within the Kubernetes cluster.
- **Admission Controllers:** Implement an admission controller (like OPA/Gatekeeper or Kyverno) to validate and restrict the `secretIDPath` field in `VaultAuth` resources to known safe locations.
## Detection
- **Indicators of Compromise:** Unusual activity in Kubernetes Audit logs showing unexpected modifications to `VaultAuth` resources, specifically those containing directory traversal characters (e.g., `../`).
- **Detection Methods:** Review VSO container logs for errors related to file reading or AppRole authentication failures that reference paths outside of the expected directory.
## References
- **Vendor Advisory:** hxxps[://]discuss[.]hashicorp[.]com/t/hcsec-2024-18-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/69742
- **HashiCorp Security:** hxxps[://]discuss[.]hashicorp[.]com/c/security/52
- **Canadian Centre for Cyber Security:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/hashicorp-security-advisory-av24-453 (Updated reference for AV serials)