CVE-2021-32923
📋 TL;DR
HashiCorp Vault and Vault Enterprise had a vulnerability where tokens or dynamic secret leases within 1 second of expiration could be renewed and incorrectly treated as non-expiring. This allowed extended access beyond intended time limits. Organizations using affected Vault versions for secrets management are impacted.
💻 Affected Systems
- HashiCorp Vault
- HashiCorp Vault Enterprise
📦 What is this software?
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Privileged tokens or secrets that should have expired remain valid indefinitely, allowing unauthorized persistent access to sensitive systems and data.
Likely Case
Accidental or intentional renewal of nearly-expired leases extends access beyond security policies, potentially violating least privilege and audit requirements.
If Mitigated
With proper monitoring and short token TTLs, impact is limited to brief policy violations that can be detected and revoked.
🎯 Exploit Status
Exploitation requires ability to renew leases, which typically requires existing valid credentials or tokens.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.9, 1.6.5, or 1.7.2
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603
Restart Required: Yes
Instructions:
1. Backup Vault data and configuration. 2. Download patched version from HashiCorp releases. 3. Stop Vault service. 4. Replace binary with patched version. 5. Restart Vault service. 6. Verify functionality.
🔧 Temporary Workarounds
Reduce token TTLs
allSet shorter maximum TTLs for tokens to minimize exposure window
vault write auth/token/tune max_lease_ttl=<shorter_duration>
Disable token renewal
allPrevent token renewal capability where not required
vault write auth/token/roles/<role_name> renewable=false
🧯 If You Can't Patch
- Implement strict monitoring for lease renewals near expiration
- Regularly audit and revoke long-lived tokens manually
🔍 How to Verify
Check if Vulnerable:
Check Vault version with 'vault version' command and compare to affected versionsCheck Version:
vault versionVerify Fix Applied:
After patching, verify version shows 1.5.9, 1.6.5, 1.7.2 or higher📡 Detection & Monitoring
Log Indicators:
- Lease renewals occurring within 1 second of max TTL
- Unexpectedly long-lived tokens in audit logs
Network Indicators:
- Unusual patterns of lease renewal API calls
SIEM Query:
source="vault" AND ("lease renewal" OR "token renewal") AND duration>max_ttl🔗 References
- https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603
- https://security.gentoo.org/glsa/202207-01
- https://www.hashicorp.com/blog/category/vault/
- https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603
- https://security.gentoo.org/glsa/202207-01
- https://www.hashicorp.com/blog/category/vault/
