Hashicorp Vault AWS IAM Integration Authentication Bypass
Posted by deepcore on October 7, 2020 – 2:05 pm
HashiCorp Vault’s AWS IAM authentication method can be bypassed by sending a serialized request to the STS AssumeRoleWithWebIdentity method as part of the authentication flow. The request triggers a JSON encoded response from the STS server, which can contain a fully-attacker controlled fake GetCallerIdentityResponse as part of its body. As the Vault response parser ignores non-xml content before and after the malicious response, this can be used to spoof arbitrary AWS identities and roles.
Post a reply
You must be logged in to post a comment.