CVE-2025-59048
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-12-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openbao | aws_plugin | to 0.1.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-694 | The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a cross-account IAM role impersonation issue in the OpenBao auth-aws plugin (versions prior to 0.1.1). It occurs because the plugin's caching mechanism does not properly validate the AWS Account ID during authentication. As a result, an IAM role from an untrusted AWS account can impersonate a role with the same name in a trusted account, gaining unauthorized access. This mainly affects environments where IAM role names are not unique across multiple AWS accounts. [2]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access by allowing an attacker to impersonate IAM roles across AWS accounts. This can result in exposure of secrets, data exfiltration, and privilege escalation within your AWS environment. It poses a high risk to confidentiality and integrity of your data and systems. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by auditing your AWS environment for duplicate IAM role names across multiple AWS accounts that interact with your OpenBao environment. Specifically, you should check for IAM roles with the same name in different accounts, as this is a prerequisite for exploitation. While no specific commands are provided, you can use AWS CLI commands such as 'aws iam list-roles' in each account and compare role names to identify duplicates. Additionally, reviewing the bound_iam_principal_arn configuration for wildcards may help identify increased attack surface. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading the auth-aws plugin to version 0.1.1 or later, where the vulnerability is patched. If upgrading is not immediately possible, ensure that IAM role names are unique across all AWS accounts that interact with your OpenBao environment by auditing and enforcing naming conventions with account-specific identifiers. Additionally, remove wildcards from the bound_iam_principal_arn configuration to reduce the attack surface, although this alone is insufficient to fully mitigate the vulnerability. [2]