Enterprise Vault Attack Surface

▶ Watch (01:44)

HashiCorp Vault, a 10-year-old Go project trusted by governments and Fortune 500 companies, is built to lock away API keys, tokens, passwords, and certificates. Shahar Tal frames the attacker’s goal hierarchy against it in three tiers: break authentication, escalate from a basic user to one holding real secrets, then reach remote code execution. RCE means full infrastructure control and free lateral movement. The talk covers two products: Vault, with 53 prior CVEs mostly minor, and CyberArk Conjur, the second most widely used secret manager.

Lockout Bypass via Username Case Normalization

▶ Watch (05:18)

Vault’s userpass authentication locks an account after five failed attempts for 15 minutes. That limit applies per entity ID, and Vault treats case variants as separate IDs. Logging in as “yenorat” and “Yenorat” and “YeNoRat” each count independently. For a six-letter username, every uppercase-lowercase permutation multiplies the window: instead of 5 attempts, an attacker gets 2 to the power of 6 times 5, which is 10,000 guesses per 15-minute block. No rate-limit is actually enforced at the account level.

MFA Bypass via Whitespace in the Username Field

▶ Watch (07:45)

Vault’s LDAP authenticator passes the submitted username to the LDAP server, which normalizes it. Vault then takes the original, un-normalized string as the alias and derives an entity ID from it. That entity ID is what gets checked against the MFA policy. LDAP strips trailing whitespace; Vault does not. So “heli “ and “heli” resolve to the same LDAP identity but produce two different entity IDs, and the new one has no MFA policy attached.

“That’s it. It’s a spacebar.” — Yarden

Any whitespace appended to the username bypasses enforced MFA entirely.

Root Token to RCE: Audit Log and Plugin Chain

▶ Watch (09:56)

Vault’s plugin loader requires a root token and checks five conditions: the plugin must exist on disk, its contents must be attacker-controlled, it must be executable, its directory path must be known, and its SHA hash must match. The audit log feature satisfies all five. Set the file backend path to the plugin directory. Use the log prefix to inject a #!/bin/bash shebang. A mode flag marks audit files executable. Load a nonexistent plugin to leak the full directory path from the error response. Run a second backend to a socket to capture the exact timestamp for hash calculation.

“probably the most significant finding” — Shahar Tal

Full HashiCorp Vault RCE chain demo (18:59)

CyberArk Conjur: Regex Flaw to Pre-Auth RCE

▶ Watch (20:46)

Conjur’s AWS IAM authenticator validates workload identity by forwarding a signed STS header to a regional AWS STS endpoint. The region is extracted via regex from the credential string, accepting anything up to the next slash. Injecting siata.ai? as the region passes that regex, turns the remainder into URL query parameters, and redirects STS validation to an attacker-controlled server with no valid AWS credentials needed. The authentication bypass lets an attacker authenticate as a policy object, then chain three type-confusion steps across Conjur’s host factory, secret, and policy factory endpoints to load arbitrary embedded Ruby and read the Conjur data key.

CyberArk Conjur pre-auth RCE demo (25:18)

CVE Totals and Defensive Recommendations

▶ Watch (27:17)

Nine CVEs in HashiCorp Vault and five in CyberArk Conjur. Both vendors patched quickly after coordinated disclosure. On defense: memory-safe languages do not stop logic bugs or overly permissive regular expressions.

“a a silver bullet, right?” — Shahar Tal

Three concrete steps: run a vault breach drill if you have never done one, monitor audit logs (SIATA is releasing a free tool called AuditFinder to flag suspicious patterns in vault trails), and review your threat model to account for the vault itself as an attack surface.

Notable Quotes

That’s it. It’s a spacebar. Yarden · ▶ 9:24

probably the most significant finding Shahar Tal · ▶ 18:01

a a silver bullet, right? Shahar Tal · ▶ 28:08

Key Takeaways

  • HashiCorp Vault’s case-insensitive username normalization multiplies the 5-attempt lockout to 10,000 tries per 15-minute window.
  • A single whitespace character appended to an LDAP username bypasses enforced MFA by creating an unrecognized entity ID.
  • A loose regex in CyberArk Conjur’s AWS STS region parser enables pre-authentication RCE with no valid credentials required.