Shahar Tal

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could exploit an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted and Conjur OSS.

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy YAML parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used for reconnaissance to understand the folder structure of the Secrets Manager/Conjur server or to have the YAML parser include files on the server in the YAML that is processed when the policy loads.

An attacker with access to a misconfigured network device routing traffic from Secrets Manager to AWS can redirect authentication requests to a malicious server under their control. CyberArk believes that very few installations are susceptible to active exploitation.

Conjur provides secrets management and application identity for infrastructure. A malformed regular expression allows an attacker manipulating headers signed by AWS to redirect the authentication validation request sent by Secrets Manager, Self-Hosted to a malicious server. This redirection could bypass the IAM Authenticator, granting the attacker permissions granted to the client whose request was manipulated.

Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and bypass permission checks.

The issue allows remote authenticated users to bypass intended access restrictions. This can lead to a private post being published and made sticky.

A cross-site scripting (XSS) issue exists due to the mishandling of unclosed HTML elements during processing of shortcode tags, allowing remote attackers to inject arbitrary web script or HTML.