{"id":5954,"date":"2025-08-07T10:01:34","date_gmt":"2025-08-07T10:01:34","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/08\/07\/hashicorp-vault-0-day-vulnerabilities-let-attackers-execute-remote-code\/"},"modified":"2025-08-07T10:01:34","modified_gmt":"2025-08-07T10:01:34","slug":"hashicorp-vault-0-day-vulnerabilities-let-attackers-execute-remote-code","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/08\/07\/hashicorp-vault-0-day-vulnerabilities-let-attackers-execute-remote-code\/","title":{"rendered":"HashiCorp Vault 0-Day Vulnerabilities Let Attackers Execute Remote Code"},"content":{"rendered":"

HashiCorp Vault 0-Day Vulnerabilities Let Attackers Execute Remote Code
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Security researchers uncovered a series of critical zero-day vulnerabilities in HashiCorp Vault in early August 2025, the widely adopted secrets management solution.<\/p>\n

These flaws, spanning authentication bypasses, policy enforcement inconsistencies, and audit-log abuse, create end-to-end attack paths that culminate in remote code execution (RCE) on Vault servers.<\/p>\n

Initial evidence of logic-level defects emerged from manual code reviews of Vault\u2019s request routing and plugin interfaces, revealing stealthy logic mismatches rather than conventional memory corruption exploits.<\/p>\n

As organizations increasingly rely on Vault to safeguard API keys, certificates, and encryption keys in multi-cloud environments, the discovery of these flaws sends shockwaves through the cybersecurity community.<\/p>\n

CYATA analysts noted<\/a> that some vulnerabilities persisted for nearly a decade, quietly embedded in core authentication flows and only recently exposed by meticulous manual auditing.<\/p>\n

\n
\"\"
Userpass Login Flow (Source \u2013 Cyata)<\/figcaption><\/figure>\n<\/div>\n

The impact extends beyond proof-of-concepts: attackers can chain these issues to bypass lockout protections in userpass and LDAP backends, evade TOTP MFA<\/a> constraints, impersonate machine identities via certificate authentication, and finally escalate privileges from admin tokens to root.<\/p>\n

The remote code execution technique is novel in Vault\u2019s history. Rather than exploiting buffer overflows, adversaries leverage the archive of audit logs\u2014written in plaintext\u2014to inject a crafted shell payload into Vault\u2019s plugin directory.<\/p>\n

\n
\"\"
LDAP Login Flow (Source \u2013 Cyata)<\/figcaption><\/figure>\n<\/div>\n

By configuring an audit backend with a custom prefix<\/code> containing a shebang and Bash commands, attackers coerce Vault into writing executable scripts.<\/p>\n

Subsequent retrieval of the exact payload via a TCP-stream audit backend allows computation of a matching SHA256 hash, satisfying Vault\u2019s plugin registration requirements and triggering code execution<\/a>.<\/p>\n

\n
\"\"
Exploit chain (Source \u2013 Cyata)<\/figcaption><\/figure>\n<\/div>\n

Organizations are urged to upgrade immediately to patched versions released alongside responsible disclosure. HashiCorp has issued advisory updates addressing all nine CVEs, reinforcing normalization routines and tightening policy checks.<\/p>\n

The coordinated response between CYATA and HashiCorp exemplifies effective vulnerability management, yet underscores the need for deep logic validation alongside standard fuzzing and penetration testing.<\/p>\n

Persistence Tactics: Audit-Log-Based Shell Injection<\/strong><\/h2>\n

The most striking persistence tactic abuses Vault\u2019s audit logging subsystem to implant malicious code.<\/p>\n

Vault supports multiple concurrent audit backends, each capable of writing structured JSON<\/a> to arbitrary file paths with configurable file modes.<\/p>\n

Attackers begin by probing the plugin catalog endpoint (POST \/v1\/sys\/plugins\/catalog\/:type\/:name<\/code>) with a non-existent plugin name, eliciting an error that leaks the absolute plugin_directory<\/code> path. Next, they enable a file-based audit backend:-<\/p>\n

audit \"file\" {\n  log_path = \"\/opt\/vault\/plugins\/evil.sh\"\n  prefix   = \"#!\/bin\/bashn$(cat \/tmp\/secret_payload)n\"\n  mode     = \"0755\"\n}<\/code><\/pre>\n
Upon sending any Vault request, the prefix is prepended to each JSON entry, causing Vault to create \/opt\/vault\/plugins\/evil.sh<\/code> with executable permissions.<\/p>\n
Simultaneously, a TCP audit backend streams the identical payload to an attacker-controlled socket, ensuring the exact bytes can be hashed. Finally, the adversary issues:-<\/p>\n
vault write sys\/plugins\/catalog\/secret\/evil \n  sha256=\"\" command=\"evil.sh\"<\/code><\/pre>\n
Vault then loads evil.sh<\/code> as a plugin, executing it within the Vault process and granting arbitrary code execution privileges.<\/p>\n
While the following table enumerates the key CVEs, their technical root causes, and attacker impacts:-<\/p>\n
\n\n\n\n\n\n\n\n\n\n\n\n
CVE<\/th>\nRoot Cause<\/th>\nAttacker Impact<\/th>\n<\/tr>\n<\/thead>\n
CVE-2025-6004<\/td>\nUsername lockout bypass via case and whitespace<\/td>\nUnlimited brute-force attempts; username enumeration<\/td>\n<\/tr>\n
CVE-2025-6011<\/td>\nTiming difference on bcrypt skip for non-existent users<\/td>\nUsername validation oracle; targeted credential attacks<\/td>\n<\/tr>\n
CVE-2025-6003<\/td>\nMFA bypass when username_as_alias=true<\/code> and EntityID mismatch<\/td>\nSilently skips TOTP requirement under certain LDAP configurations<\/td>\n<\/tr>\n
CVE-2025-6016<\/td>\nCombined TOTP logic flaws (replay, rate limit evasion)<\/td>\nBrute-force valid TOTP codes; bypass one-time use and rate-limiting<\/td>\n<\/tr>\n
CVE-2025-6037<\/td>\nCN unchecked in non-CA cert auth<\/td>\nImpersonation of arbitrary machine identities with valid public key<\/td>\n<\/tr>\n
CVE-2025-5999<\/td>\nPolicy normalization mismatch<\/td>\nAdmin can assign \" root\"<\/code> or uppercase \"ROOT\"<\/code> policy names to escalate to root<\/code> privileges<\/td>\n<\/tr>\n
CVE-2025-6000<\/td>\nAudit-log prefix abuse for plugin creation<\/td>\nRemote code execution with no memory corruption via malicious audit-log-backed plugin registration<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n
This wave of logic-level vulnerabilities highlights that even memory-safe architectures can harbor critical flaws when input normalization and policy enforcement diverge.<\/p>\n
Cybersecurity teams must augment black-box testing with thorough source analysis to uncover subtle trust-model inconsistencies before adversaries exploit them.<\/p>\n
Equip your SOC with full access to the latest threat data from\u00a0ANY.RUN TI Lookup<\/strong>\u00a0that can Improve incident response ->\u00a0Get 14-day\u00a0Free\u00a0Trial<\/a><\/strong><\/p>\n
The post HashiCorp Vault 0-Day Vulnerabilities Let Attackers Execute Remote Code<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
HashiCorp Vault 0-Day Vulnerabilities Let Attackers Execute Remote Code Security researchers uncovered a series of critical zero-day vulnerabilities in HashiCorp Vault in early August 2025, the widely adopted secrets management solution. These flaws, spanning authentication bypasses, policy enforcement inconsistencies, and audit-log abuse, create end-to-end attack paths that culminate in remote code execution (RCE) on Vault […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-5954","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5954"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=5954"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5954\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=5954"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=5954"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=5954"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}