CVE-2023-5077
📋 TL;DR
This vulnerability in HashiCorp Vault's Google Cloud secrets engine removes existing IAM Conditions when creating or updating rolesets, potentially granting unintended permissions. It affects Vault and Vault Enterprise users who utilize the Google Cloud secrets engine. The issue could lead to privilege escalation or unauthorized access to Google Cloud resources.
💻 Affected Systems
- HashiCorp Vault
- HashiCorp Vault Enterprise
📦 What is this software?
Vault by Hashicorp
Vault by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain unauthorized access to sensitive Google Cloud resources, modify critical infrastructure, or exfiltrate data by exploiting missing IAM Conditions that were intended to restrict access.
Likely Case
Accidental privilege escalation where users or services gain broader access than intended due to missing IAM Conditions, potentially violating least privilege principles.
If Mitigated
With proper monitoring and access controls, unauthorized access attempts would be detected and blocked, limiting the impact to audit trail anomalies.
🎯 Exploit Status
Exploitation requires access to Vault with permissions to create or update Google Cloud rolesets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.13.0
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654
Restart Required: Yes
Instructions:
1. Backup Vault configuration and data. 2. Upgrade Vault to version 1.13.0 or later. 3. Restart Vault service. 4. Verify Google Cloud rolesets have correct IAM Conditions.
🔧 Temporary Workarounds
Manual IAM Condition Verification
allManually verify and reapply IAM Conditions after any roleset creation or update
gcloud iam roles describe [ROLE_ID] --project=[PROJECT_ID]
🧯 If You Can't Patch
- Temporarily disable Google Cloud secrets engine if not critical
- Implement strict audit logging and monitoring for roleset changes
🔍 How to Verify
Check if Vulnerable:
Check Vault version with 'vault version'. If version is below 1.13.0 and Google Cloud secrets engine is enabled, system is vulnerable.Check Version:
vault versionVerify Fix Applied:
After upgrading to 1.13.0+, create a test roleset with IAM Conditions and verify they persist after updates.📡 Detection & Monitoring
Log Indicators:
- Unusual roleset creation/modification patterns
- Google Cloud API calls from unexpected sources
Network Indicators:
- Increased Google Cloud API traffic from Vault instances
SIEM Query:
source="vault" AND (event="roleset_creation" OR event="roleset_update")🔗 References
- https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654
- https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654
