OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path.
Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 7
https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
security-advisories@github.com
https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914a…
security-advisories@github.com
https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b99…
security-advisories@github.com
https://github.com/openbao/openbao/pull/3389
security-advisories@github.com
https://github.com/openbao/openbao/pull/3474
security-advisories@github.com
https://github.com/openbao/openbao/releases/tag/v2.6.0
security-advisories@github.com
https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr
security-advisories@github.com