Path Traversal in OpenBao Transit Key Import

Executive Summary

This is a path traversal vulnerability in OpenBao's Transit key import feature. It allows authenticated attackers with limited ACL policies to bypass name restrictions by crafting traversal sequences during key import. This lets them write key material under arbitrary Transit key names, bypassing intended access controls.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the OpenBao version installed on your system. Run the command 'openbao version' or 'vault version' to verify if you are using a vulnerable version (prior to 2.6.5 or 2.7.2). Additionally, review ACL policies for Transit key import restrictions to identify potential misconfigurations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to import keys under unauthorized names, potentially gaining access to sensitive data or manipulating systems. The attack requires low privileges and no user interaction, making it exploitable over a network with minimal conditions. Confidentiality and integrity are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data manipulation, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance risks include legal penalties, data breaches, and loss of trust. Organizations must patch to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenBao to a patched version (2.6.5 or later, or 2.7.2 or later). If using the 2.6.x series, note it is unsupported. Review and restrict ACL policies to prevent unauthorized Transit key imports. Monitor for suspicious key import activities in logs.

Useful 0 Not Useful 0