GHSA-5pmx-2p74-x478: OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import
OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a requiredparameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.2
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments running OpenBao versions before 2.6.5 or 2.7.2 are affected where an authenticated identity can use Transit key import and is restricted by an ACL required_parameters name constraint.
What access does an attacker need?
An attacker needs authenticated access with permission to import Transit key material. No user interaction is required, and the attack can be performed over the network.
What can an attacker do with this flaw?
They can use traversal sequences in the import request to bypass the ACL name restriction and write key material under arbitrary Transit key names.
How can I determine whether an ACL policy is vulnerable to this bypass?
Review Transit key-import permissions for ACL policies that rely on a required_parameters constraint for the key name. Those constraints can be bypassed by affected versions during Transit key import.
What should be done if upgrading cannot happen immediately?
Restrict or remove Transit key-import access for identities that are constrained only by required_parameters name restrictions, since those restrictions do not reliably limit import destinations on affected versions.