CVE-2025-49831
📋 TL;DR
This vulnerability allows attackers to reroute authentication requests from Secrets Manager to malicious servers when network devices are misconfigured. It affects CyberArk Secrets Manager Self-Hosted (formerly Conjur Enterprise) prior to versions 13.5.1/13.6.1 and Conjur OSS prior to version 1.22.1. Exploitation requires specific network misconfigurations that CyberArk believes are rare.
💻 Affected Systems
- CyberArk Secrets Manager Self-Hosted
- Conjur Enterprise
- Conjur OSS
📦 What is this software?
Conjur by Cyberark
Conjur by Cyberark
Conjur by Cyberark
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of authentication credentials and secrets managed by Secrets Manager, potentially leading to full system takeover and credential theft.
Likely Case
Limited authentication interception in specific misconfigured environments, potentially allowing unauthorized access to some secrets.
If Mitigated
No impact with proper network segmentation, TLS validation, and updated software.
🎯 Exploit Status
Exploitation requires control over network routing and specific misconfigurations. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Secrets Manager Self-Hosted 13.5.1 or 13.6.1; Conjur OSS 1.22.1
Vendor Advisory: https://github.com/cyberark/conjur/security/advisories/GHSA-952q-mjrf-wp5j
Restart Required: Yes
Instructions:
1. Backup current configuration and secrets. 2. Download patched version from CyberArk portal or GitHub releases. 3. Stop Secrets Manager services. 4. Apply patch/upgrade following vendor documentation. 5. Restart services and verify functionality.
🔧 Temporary Workarounds
Network Segmentation and TLS Validation
allImplement strict network controls and ensure TLS certificate validation for all AWS communications
Network Device Configuration Review
allAudit and secure all network devices between Secrets Manager and AWS endpoints
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Secrets Manager traffic
- Deploy network monitoring and intrusion detection for authentication traffic anomalies
🔍 How to Verify
Check if Vulnerable:
Check version: For Conjur OSS run 'conjur --version', for Secrets Manager check admin interface or deployment manifests.Check Version:
conjur --version # For Conjur OSS; check deployment manifests for Secrets ManagerVerify Fix Applied:
Confirm version is >= 13.5.1/13.6.1 for Secrets Manager or >= 1.22.1 for Conjur OSS. Test authentication flows to AWS endpoints.📡 Detection & Monitoring
Log Indicators:
- Unexpected authentication failures
- Authentication requests to unusual IP addresses
- TLS certificate validation errors
Network Indicators:
- Authentication traffic to non-AWS endpoints
- Unusual routing patterns for Secrets Manager traffic
SIEM Query:
source="secrets-manager" AND (event_type="auth_failure" OR dest_ip NOT IN aws_ip_ranges)