CVE-2020-12757 Improper Input Validation in HashiCorp Vault
Attackers can obtain GCP credentials with longer validity than intended when using the GCP Secrets Engine, potentially extending access windows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12757?
CVE-2020-12757 is a critical vulnerability in Hashicorp Vault, published on 10 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.
Weakness: CWE-269
Which versions are affected by CVE-2020-12757?
4 open source packages ship an affected version, including github.com/hashicorp/vault-plugin-secrets-gcp and vault. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/vault-plugin-secrets-gcp Go | All versions | 0.6.2 |
github.com/hashicorp/vault-plugin-secrets-gcp Go | All versions | 0.6.2 |
github.com/hashicorp/vault-plugin-secrets-gcp Go | All versions | 0.6.2 |
vault Bitnami | From 1.4.0 | 1.4.2 |
Products include Hashicorp Vault.
How do I fix CVE-2020-12757?
Upgrade github.com/hashicorp/vault-plugin-secrets-gcp to 0.6.2 or later.
Is CVE-2020-12757 being exploited?
There is no known exploitation of CVE-2020-12757 in the wild and no public exploit code.
Other vulnerabilities in Hashicorp Vault
Sources
Also known as BIT-vault-2020-12757, GHSA-75pc-qvwc-jf3g, GO-2022-0804.