Vault audit log prefix injection vulnerability

Executive Summary

This vulnerability in HashiCorp Vault allows a privileged operator to inject malicious content into audit logs by exploiting unvalidated audit device prefixes. The issue occurs because Vault does not sanitize or validate these prefixes, enabling control characters or line separators to be inserted. This can cause log consumers to misinterpret a single audit entry as multiple records, potentially inserting forged entries alongside legitimate ones.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Vault audit device configurations for enabled prefixes and verify if allow_audit_log_prefixing is set to false. Check log files for unexpected control characters or line separators in audit entries. Use commands like 'vault audit list' to review audit devices and 'grep' to search for suspicious patterns in logs.

Useful 0 Not Useful 0

Impact Analysis

The impact includes forged or misleading audit records, which could lead to incorrect security assessments or compliance violations. Attackers with sufficient privileges could manipulate logs to hide malicious activities or frame legitimate users. The vulnerability specifically affects file audit devices when the allow_audit_log_prefixing setting is enabled and socket/syslog devices even when the setting is disabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could undermine compliance with regulations requiring accurate and tamper-proof audit logs, such as GDPR and HIPAA. Forged or misleading audit records may result in non-compliance, potential fines, or legal consequences due to compromised log integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vault to fixed versions: Community Edition 2.2.2 or Enterprise 2.2.2, 1.21.14, or 1.19.25. Disable audit log prefixing by setting allow_audit_log_prefixing=false in server configuration. Review and update audit device configurations to remove any existing prefixes.

Useful 0 Not Useful 0