Cipherboy

A missing authorization check allows attackers to stop Agent and Proxy services by omitting the `X-Vault-Header`. When the `require request header` setting is enabled, attackers can utilize server-side request forgery (SSRF)—a technique that allows an attacker to induce the server-side application to make requests to an unintended location—to send requests to the '/agent/v1/quit' and '/proxy/v1/quit' endpoints to shut down these services.

The AppRole authentication method fails to verify the expiration of the Secret ID during use. This allows an attacker possessing an expired Secret ID that has not yet been removed by the periodic tidy process to authenticate and gain unauthorized access beyond the intended Time To Live (TTL), which is the duration for which a token or secret is valid.

An information disclosure issue exists where attackers can leak sensitive data into audit logs by sending malformed plugin parameters. By submitting requests with malformed `TypeKVPair` or `TypeHeader` field values, error messages containing the sensitive input are recorded in the logs.

The UI's OIDC identity provider allows unauthenticated users to be redirected to external, attacker-controlled destinations via specially crafted OIDC links. This issue can be leveraged to facilitate phishing attacks or the theft of user credentials.

An ACL bypass occurs when explicit deny rules based on forbidden identity metadata templates within wildcard grants are silently dropped. This allows attackers with identity metadata containing wildcard or path segments to access paths that should be restricted within the broader wildcard-granted scope.

An issue exists in the identity-based secrets management system where an initial failure during namespace deletion causes subsequent retries to fail to remove all data before the namespace is marked as deleted. This may result in outstanding leases remaining active or unrelated storage entries being left behind.

OpenBao’s Login Multi-Factor Authentication (MFA) system, utilizing Time-based One Time Password (TOTP), accepted codes containing whitespace due to normalization applied by the underlying TOTP library. This bypassed internal rate limiting, allowing reuse of existing MFA codes.

OpenBao is a software solution for managing, storing, and distributing sensitive data. In affected versions, accounts with access to highly-privileged identity entity systems in root namespaces could increase their scope directly to the root policy. The identity system allowed adding arbitrary policies with capability grants on arbitrary paths, but the root policy was restricted to manual generation. The global root policy was not accessible from child namespaces.

Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP authentication systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions.

OpenBao is a software solution designed for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, user enumeration was possible when using the userpass authentication method due to timing differences between non-existent users and users with stored credentials. This issue occurred regardless of the validity of the supplied credentials.

OpenBao’s TOTP secrets engine could accept valid Time-based One-Time Password (TOTP) codes multiple times instead of strictly once. This issue stemmed from unexpected normalization within the underlying TOTP library. TOTP code verification is a privileged action and should only be performed by trusted systems.

OpenBao allows the assignment of policies and MFA attribution based on entity aliases. When the `username as alias=true` parameter in the LDAP auth method is used, the supplied username is used without normalization, potentially allowing an attacker to bypass alias-specific MFA requirements.

Name of the Vulnerable Software and Affected Versions: OpenBao versions prior to 2.3.0 Description: The issue concerns the potential leak of sensitive information in logs when processing malformed data. This problem has been identified in OpenBao, a software solution designed to manage, store, and distribute sensitive data, including secrets, certificates, and keys. There are no known real-world incidents or estimated numbers of affected devices mentioned. Recommendations: For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue. As a temporary workaround, ensure properly formatted requests from all clients to minimize the risk of sensitive information leakage.

Name of the Vulnerable Software and Affected Versions: OpenBao versions prior to 2.3.0 Description: OpenBao is a software solution for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. The issue allows an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, resulting in a denial of service. Recommendations: For OpenBao versions prior to 2.3.0, manually set the configuration option `disable unauthed rekey endpoints=true` to deny these endpoints on global listeners. As a temporary workaround, if an active proxy or load balancer sits in front of OpenBao, consider denying requests to these endpoints from unauthorized IP ranges. Update to version 2.3.0 or later, where the issue is resolved.

Name of the Vulnerable Software and Affected Versions: MonicaHQ version 4.1.1 Description: The issue allows attackers to exploit authenticated client-side injection in journal entry edits, with a medium severity level. A patch is pending, and users should monitor updates closely. Recommendations: For version 4.1.1, update to a newer version once the pending patch is released to resolve the issue. As a temporary workaround, consider restricting access to journal entry edits until the patch is available.