Vaulted Severance: Your Secrets Are Now Outies

Vaulted Severance: Your Secrets Are Now Outies

Speakers: Shahar Yair and Yarden Porat, Sayata

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=KC-8DhS8x5Q

Reading Time: ~8 minutes

Type: Briefing

TL;DR

Researchers from Sayata disclosed nine CVEs in HashiCorp Vault and five CVEs in CyberArk Conjur, including the first-ever remote code execution reported against Vault and a pre-authentication RCE in Conjur. The attacks chain authentication bypasses and privilege escalation to full root-level shell access from a plain, default user account.

Introduction

Enterprise secret vaults — systems designed to store and control access to API keys, tokens, certificates, and encryption keys — sit at the top of the trust hierarchy in modern security architectures. When they fall, everything falls with them. Yet these systems often operate under an implicit assumption that they are fundamentally harder to compromise than the assets they protect.

Shahar Yair and Yarden Porat of Sayata, a company building control-plane infrastructure for agentic identities, set out to audit that assumption. Their team, with deep roots in vulnerability research at firms including Cellebrite, focused on the two most widely deployed secret managers: HashiCorp Vault and CyberArk Conjur. The result was a chain of vulnerabilities that, when combined, takes an attacker from a default user account all the way to remote code execution — extracting every secret in the deployment.

The Threat Model: Five Ways Into a Vault

Before diving into specific bugs, the presenters laid out the attack surface any vault must defend: brute-force credential attacks, MFA weakening or bypass, privilege escalation from basic to admin roles, and full remote code execution for complete infrastructure control. Each category represents a progressively worse outcome, with RCE being the "holy grail" that grants lateral movement throughout the environment.

▶ Watch: Threat Model Overview (02:00)

HashiCorp Vault had accumulated 53 CVEs over the prior decade, most of them minor. The most significant prior research came from Felix Wilhelm at Google Project Zero in 2020, who uncovered authentication bypasses in Vault's cloud-native roles. That stood as the worst-known finding — until Porat began digging.

Bug 1: Case-Sensitivity Lockout Bypass in Vault's Userpass Auth

Vault's userpass authentication enforces a five-attempt lockout before locking an account for 15 minutes — a reasonable rate-limiting control. However, Porat found that the lockout counter is tied to a case-sensitive version of the username. By varying letter casing (e.g., "Yarden Porat" vs. "YARDEN Porat" vs. "yarden PORAT"), an attacker can generate an enormous number of effective attempts against the same password.

▶ Watch: Lockout Bypass Demo (06:00)

For a ten-character name like "Yarden Porat," the math is stark: instead of five attempts every 15 minutes, an attacker effectively gets 2^10 × 5 = 5,120 attempts per window. The technique requires no special access — only knowledge of a valid username.

Bug 2: MFA Bypass via LDAP Username Normalization Discrepancy

The more severe authentication finding exploits a subtle mismatch between how Vault and its upstream LDAP server process usernames. In LDAP-backed authentication with MFA enforced, Vault sends the username to the LDAP server, which normalizes it (for example, stripping trailing whitespace). Vault then uses the original, un-normalized username to create an entity ID, and looks up whether MFA is required for that entity.

The exploit is disarmingly simple: append a space character to the username. LDAP normalizes it and validates the credentials successfully. But Vault creates a new entity ID for the space-padded username — an entity that has no MFA policy attached. The MFA challenge is never issued, and the attacker authenticates with valid credentials but zero second-factor friction.

▶ Watch: MFA Bypass — "Don't Blink, It's a Space Bar" (08:00)

The presenters called this the most significant finding in Vault's project history.

Bug 3: Root Token to RCE via Vault's Plugin and Audit System

With a root token in hand (obtained via privilege escalation primitives detailed in the full write-up), the researchers sought remote code execution. Vault's plugin system allows loading custom authentication methods, secret engines, and databases via an HTTP endpoint — but it imposes several guards: the plugin must reside in a pre-configured directory, must carry an executable bit, and its SHA-256 hash must be provided at load time.

All five constraints were defeated by chaining two legitimate Vault features: the audit logging system and the plugin loader.

1. File creation: Vault's audit backend can write logs to any file path — including inside the plugin directory.
2. Controlled content: Audit log entries reflect attacker-controlled request data.
3. Executable bit: Vault's audit system has a configuration option to write log files with the executable flag set — a feature that exists by design.
4. Plugin directory discovery: Loading a non-existent plugin triggers an error message that leaks the full plugin directory path in the HTTP response.
5. Hash prediction: By enabling a second audit backend (a socket) alongside the file backend, the attacker can receive audit log entries in real time, compute the SHA-256 of the file as it exists on disk, and provide the correct hash on demand.

▶ Watch: RCE Chain Demo (12:01)

The full chain — starting from a plain user with a client certificate, escalating to admin via one privilege escalation, escalating to root token via a second, then triggering RCE — played out live on stage and resulted in exfiltration of all secrets in the deployment.

CyberArk Conjur: Pre-Authentication RCE via STS Endpoint Spoofing

The second half of the talk addressed CyberArk Conjur, the second most widely deployed secret manager and a system increasingly used for machine and AI agent identities. Conjur supports AWS IAM authentication by forwarding signed AWS identity tokens to AWS STS (Secure Token Service) for validation.

The critical flaw: Conjur extracts the AWS region from the credential string using a regular expression that is far too permissive. An attacker can supply a crafted region value — for example, sayata.ai — and append a ? character to convert the remainder of the AWS STS URL into query parameters. Conjur then sends the validation request to the attacker-controlled server rather than AWS.

▶ Watch: Conjur AWS Authentication Bypass (22:02)

With authentication bypass achieved, the researchers proceeded to escalate through three type confusion vulnerabilities — against Conjur's host factory, secret endpoint, and policy factory — to load arbitrary Embedded Ruby (ERB) code, achieving a full reverse shell on the Conjur node. This constitutes a pre-authentication RCE: an unauthenticated attacker with network access to Conjur can achieve complete code execution.

▶ Watch: Conjur RCE Demo (26:02)

In total, the research disclosed 9 CVEs against HashiCorp Vault and 5 CVEs against CyberArk Conjur. Both vendors responded quickly and coordinated fixes before disclosure.

Notable Quotes

"Memory safety is not gonna be a silver bullet. Go is great, but it's not gonna stop a logic bug or an overly trusting regular expression."

— Shahar Yair ▶ 28:02

"When was the last time you ran a vault breach drill? If the answer is never, maybe now is the time."

— Shahar Yair ▶ 28:02

"Thank you, HashiCorp developer, who enabled this feature for me."

— Yarden Porat, on the audit log executable-bit flag ▶ 16:01

"Both vendors responded very quickly, professionally, and seriously. We communicated clearly, coordinated fixes, and both worked with us to make sure this was handled the right way."

— Shahar Yair ▶ 26:02

Key Takeaways

• Even vaults are vulnerable. Threat models must account for secret manager compromise. Organizations should have a vault breach response plan and practice it regularly.
• Memory-safe languages don't eliminate logic bugs. Both Vault (Go) and Conjur (Ruby) contained exploitable flaws that no type system or memory safety model would have caught.
• Normalization discrepancies are a perennial attack surface. The LDAP MFA bypass exploits a one-character difference in how two systems interpret the same username — a class of bug that appears across authentication stacks.
• Audit logs are a detection lifeline — only if monitored. Vaults generate detailed audit trails. Sayata is releasing an open-source tool called Audit Finder to help detect suspicious behavior in Vault audit logs.
• Least privilege on vault admin accounts matters. The RCE chain required a root token as a prerequisite. Restricting and monitoring root token usage limits an attacker's ability to reach the plugin system.

Slides

No slides PDF was listed for this talk. Full technical write-up, CVE details, detection guidance, and the Audit Finder tool are available at sayata.ai.