Path Traversal in hashi-vault-js Node.js Module

Executive Summary

hashi-vault-js before 0.5.2 concatenates unencoded user-controlled values like name, username, group, role, and version directly into Vault request paths and query strings. This allows attackers to craft malicious inputs that manipulate the URL structure, enabling path traversal and query parameter injection attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves path traversal and query parameter injection due to improper encoding in Vault.js. To detect it, inspect Node.js applications using hashi-vault-js versions prior to 0.5.2 for unencoded user-supplied input in URL paths or query strings. Check application logs for unusual Vault API requests containing path segments like '../' or query parameters with malicious payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access unauthorized files or data on the server by manipulating paths, or inject malicious query parameters to alter application behavior. This could lead to data breaches, privilege escalation, or service disruption if the Vault instance is exposed to untrusted networks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade hashi-vault-js to version 0.5.2 or later immediately. Review and sanitize all inputs used in Vault API requests to ensure proper encoding. Monitor network traffic for suspicious Vault API calls and restrict access to Vault endpoints if possible.

Useful 0 Not Useful 0