Tweet
Oxeye’s cloud security platform discovered a high-severity zero-day vulnerability in a secrets management system completely autonomously - with no manual input or intervention.
According to the company, its cloud-native application security platform found a zero-day in HashiCorp Vault Project, a popular identity-based secrets and encryption management system used to control access to API encryption keys, passwords, and certificates.
The flaw was an SQL injection vulnerability that could have allowed threat actors remote code execution (RCE) capabilities. It is now tracked as CVE-2023-0620. The flaw has since been addressed and a patch has been released.
[HEADING=1]Patches released[/HEADING]
Oxeye said its Application Security Platform identified the zero-day as part of a standard deployment scan, and concluded that threat actors could have used it to access sensitive data, play with it, and even run malicious apps on the target endpoints.
“Given the trend toward microservices in modern software development, configuration-based attacks like this are a significant threat and are expected to become more common.
Read more
"Because the centralized nature of configurations makes them a single point of truth, they are a lucrative target for threat actors. As such, organizations should prioritize the security of configuration files and other centralized components in modern applications,” the researchers conclude.
After disclosing the flaw to HashiCorp, the company released patches 1.13.1, 1.12.5, and 1.11.9.
“The importance of restricting access to critical tools and implementing adequate input validation to prevent SQL injection attacks is highlighted by this vulnerability in HashiCorp’s Vault project,” said Ron Vider, CTO and Co-Founder for Oxeye. “To safeguard your environment, swiftly applying patches and ensuring security policies are current will ensure successful attacks are avoided.”
[ul]
[li]Check out the best firewalls[/li][/ul]
Continue reading…
According to the company, its cloud-native application security platform found a zero-day in HashiCorp Vault Project, a popular identity-based secrets and encryption management system used to control access to API encryption keys, passwords, and certificates.
The flaw was an SQL injection vulnerability that could have allowed threat actors remote code execution (RCE) capabilities. It is now tracked as CVE-2023-0620. The flaw has since been addressed and a patch has been released.
[HEADING=1]Patches released[/HEADING]
Oxeye said its Application Security Platform identified the zero-day as part of a standard deployment scan, and concluded that threat actors could have used it to access sensitive data, play with it, and even run malicious apps on the target endpoints.
“Given the trend toward microservices in modern software development, configuration-based attacks like this are a significant threat and are expected to become more common.
Read more
Microsoft, Google and Apple zero-days were a huge security threat in 2022
Apple’s recent zero-days patch is now available for older devices
These are the best identity theft solutions right now
Apple’s recent zero-days patch is now available for older devices
These are the best identity theft solutions right now
After disclosing the flaw to HashiCorp, the company released patches 1.13.1, 1.12.5, and 1.11.9.
“The importance of restricting access to critical tools and implementing adequate input validation to prevent SQL injection attacks is highlighted by this vulnerability in HashiCorp’s Vault project,” said Ron Vider, CTO and Co-Founder for Oxeye. “To safeguard your environment, swiftly applying patches and ensuring security policies are current will ensure successful attacks are avoided.”
[ul]
[li]Check out the best firewalls[/li][/ul]
Continue reading…