Medium, CVSS 6.3PyPIAmendedPublished
vault-cli contains possible RCE when reading user-defined data
CVE-2021-43837 · GHSA-q34h-97wf-8r8j
- Affected
- PyPI vault-cli >= 0.7.0, < 3.0.0
- Fixed in
- 3.0.0· Vendor fix available
- Issue
- Impact What kind of vulnerability is it? Who is impacted? vault-cli features the ability for rendering templated values (as explained in the documentation). When a secret starts with the prefix !template!, vault-cli interprets the rest of the contents of the secret as a Jinja2 template. Jinja2 is a powerful templating engine and it's not designed to safely render arbitrary templates. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code, making this a Remote Code Execution (RCE) risk. If the content of the vault can be completely trusted, then this is not a problem. Otherwise, if your threat model includes cases where an attacker can manipulate a secret value read from the vault using vault-cli, then this vulnerability may impact you. This does not impact vault itself, except for the fact that the attacker, having an RCE on the machine that executes vault-cli, may abuse the token that vault-cli uses, to read, write or delete other data from the…
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.