Vault ACL Policy Bypass via Trailing Slash in Path

Executive Summary

Vault Community Edition and Vault Enterprise had a flaw where ACL deny policies were not consistently applied to paths differing only by a trailing slash. This allowed authenticated users with broader delete permissions to bypass explicit deny rules meant to protect secrets engines, auth methods, or audit devices.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check your Vault server version using the command: vault version. If the version is below 2.2.2 for Community Edition or below 2.2.2, 1.21.14, or 1.19.25 for Enterprise Edition, the system is vulnerable. Review ACL policies for paths with and without trailing slashes to identify potential bypasses.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could disable protected resources like secrets engines or audit devices by exploiting the trailing slash bypass in ACL deny rules, potentially leading to unauthorized access or data loss.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could compromise access controls required by GDPR and HIPAA, potentially leading to unauthorized data exposure or system modifications, violating compliance requirements for data protection and audit logging.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.25. After upgrading, review and update ACL policies to ensure both path forms (with and without trailing slashes) are explicitly denied where needed.

Useful 0 Not Useful 0