Get the latest tech news
Researchers Uncover RCE Attack Chains in HashiCorp Vault and CyberArk Conjur
Open-source credential management systems HashiCorp Vault and CyberArk Conjur had flaws enabled remote code execution among other attacks.
Researchers have found 14 logic flaws in various components of HashiCorp Vault and CyberArk Conjur, two open-source credential management systems, allowing attacks that could bypass authentication checks, access secrets, impersonate identities and execute arbitrary code. Their findings, which include 14 vulnerabilities that enable remote code execution (RCE) attack chains in both products, were presented today at the Black Hat USA security conference in Las Vegas. As with Conjur, Cyata researchers conducted manual code reviews of Vault, focusing on logic flaws in components responsible for authentication and policy enforcement, rather than memory corruption or race conditions typically detected by automated tools.
Or read this on Hacker News