CRITICAL ZERO-DAYS CRACK OPEN CYBERARK AND HASHICORP PASSWORD VAULTS

Summary from the TLDR InfoSec newsletter

A team of researchers discovered nine zero-days in HashiCorp Vault and five in CyberArk Conjur, which they were able to chain to achieve RCE against both platforms. The researchers discovered that they could trick Conjur into performing authentication against their own server instead of an AWS server and then escalate privileges by authenticating as a policy instead of a user. Conjur's “Policy Factory” also allows for embedding Ruby in policies, leading to RCE. The HashiCorp Vault vulnerabilities included username enumeration, authentication lockout bypasses, MFA and certificate authentication bypasses, and a privilege escalation from admin to root, which could allow for RCE.