CVE-2025-1293
📋 TL;DR
CVE-2025-1293 is an authentication bypass vulnerability in Hermes versions up to 0.4.0 that improperly validates AWS ALB JWTs, potentially allowing unauthorized access to protected resources. Organizations using Hermes with AWS ALB authentication mode are affected. The vulnerability was fixed in Hermes 0.5.0.
💻 Affected Systems
- Hashicorp Hermes
📦 What is this software?
Hermes by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain unauthorized administrative access to Hermes instances, potentially compromising sensitive documents and user data.
Likely Case
Unauthorized users bypass authentication to access protected documents and resources they shouldn't have access to.
If Mitigated
With proper network segmentation and access controls, impact is limited to the Hermes application layer only.
🎯 Exploit Status
Requires knowledge of AWS ALB JWT structure and ability to craft malicious tokens
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Hermes 0.5.0
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2025-03-hashicorp-hermes-improperly-validates-aws-alb-jwts-which-may-lead-to-authentication-bypass/73371
Restart Required: No
Instructions:
1. Upgrade Hermes to version 0.5.0 or later
2. Verify the upgrade completed successfully
3. Test authentication functionality
🔧 Temporary Workarounds
Disable AWS ALB Authentication
allTemporarily disable AWS ALB authentication mode until patching can be completed
Implement Additional Authentication Layer
allAdd network-level authentication or web application firewall rules to validate JWT tokens
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Hermes instances
- Enable detailed logging and monitoring for authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check Hermes version and verify if AWS ALB authentication is enabledCheck Version:
hermes --versionVerify Fix Applied:
Verify Hermes version is 0.5.0 or later and test authentication with valid/invalid JWTs📡 Detection & Monitoring
Log Indicators:
- Failed JWT validation attempts
- Unusual authentication patterns
- Access from unexpected IP addresses
Network Indicators:
- Unusual traffic patterns to Hermes authentication endpoints
- Suspicious JWT token structures
SIEM Query:
source="hermes" AND (event="authentication_failure" OR event="jwt_validation_error")