Skip to content

Latest commit

 

History

History
78 lines (67 loc) · 7.14 KB

attack-surface.md

File metadata and controls

78 lines (67 loc) · 7.14 KB

Attack Surface Analysis for hashicorp/vault

Attack Surface: Storage Backend Compromise (Vault-Direct Aspect)

  • Description: Unauthorized access to Vault's storage backend, leading to direct manipulation of Vault's encrypted data.
  • How Vault Contributes: Vault relies on the storage backend for persistence, but the direct Vault-related risk is the potential for an attacker to bypass Vault's access controls by directly interacting with the encrypted data. This is distinct from simply compromising the backend's infrastructure.
  • Example: An attacker, having gained access to the storage backend, attempts to decrypt Vault's data using known or brute-forced encryption keys, or modifies the stored data to inject malicious entries.
  • Impact: Complete compromise of all secrets, encryption keys, and audit logs stored in Vault. Attacker can potentially read, modify, or delete all Vault data, even if they cannot unseal Vault normally.
  • Risk Severity: Critical
  • Mitigation Strategies (Vault-Direct Focus):
    • Developers/Users:
      • Ensure Vault is configured to use a storage backend that supports encryption and that Vault can leverage that encryption for its own data protection (e.g., using a KMS). This adds a layer of defense even if the backend is accessed directly.
      • Regularly rotate Vault's master key. This limits the impact of a potential key compromise.
      • Implement strict access controls within Vault to limit which users/applications can access which secrets, even if the storage backend is compromised. This is defense-in-depth.

Attack Surface: Unsealing Key/Shards Compromise

  • Description: Unauthorized acquisition of the unsealing keys or a sufficient number of Shamir's Secret Sharing shards.
  • How Vault Contributes: This is entirely a Vault-specific risk. Vault's security model is fundamentally based on the secrecy of these keys/shards.
  • Example: An attacker gains access to a configuration file or environment variable where an unseal key is mistakenly stored.
  • Impact: Attacker can unseal Vault and gain full access to all stored secrets.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Developers/Users:
      • Use Shamir's Secret Sharing with a high threshold (e.g., 3-of-5).
      • Distribute the shards to different, trusted individuals or systems. Never store all shards together.
      • If using auto-unseal (via a KMS), carefully evaluate the security implications and trust model of the KMS provider. Ensure the KMS itself is highly secure.
      • Implement strict physical and logical access controls around the storage and handling of unseal keys/shards.
      • Regularly rotate unseal keys/shards.
      • Implement multi-factor authentication for any manual unsealing process.

Attack Surface: Vault API Exposure and Vulnerabilities (Direct Exploitation)

  • Description: Exploitation of vulnerabilities within Vault's API code or unauthorized access due to misconfigured API access controls.
  • How Vault Contributes: This is a direct risk related to the Vault software itself and its exposed API.
  • Example: An attacker exploits a zero-day vulnerability in Vault's API to bypass authentication and gain administrative access.
  • Impact: Varies depending on the vulnerability, but could range from information disclosure to complete system compromise (control of Vault).
  • Risk Severity: High to Critical (depending on the specific vulnerability)
  • Mitigation Strategies:
    • Developers/Users:
      • Keep Vault updated to the latest version to patch known vulnerabilities. Subscribe to HashiCorp security advisories and act immediately on critical updates.
      • Implement strict network ACLs to allow access to the Vault API only from authorized client IPs/networks.
      • Enable and regularly review Vault's audit logs, looking for any signs of unauthorized access attempts or exploitation.
      • Regularly perform penetration testing specifically targeting the Vault API.

Attack Surface: Client Token Leakage/Compromise (Leading to Vault Access)

  • Description: Unauthorized access to a valid Vault client token, allowing an attacker to directly interact with Vault.
  • How Vault Contributes: Vault issues these tokens, and their compromise directly impacts Vault's security.
  • Example: A compromised CI/CD pipeline leaks a Vault token, which an attacker uses to retrieve secrets from Vault.
  • Impact: Attacker can impersonate the client and access any secrets the token is authorized to access within Vault.
  • Risk Severity: High to Critical (depending on the token's permissions)
  • Mitigation Strategies (Vault-Direct Focus):
    • Developers:
      • Use short-lived tokens (minimize TTL) within Vault. This is a core Vault configuration.
      • Use token wrapping (Cubbyhole response wrapping) for secure token delivery. This is a Vault feature.
      • Use AppRole or other authentication methods that minimize the exposure of long-lived credentials to Vault.
      • Revoke tokens immediately if compromise is suspected using Vault's revocation mechanisms.
      • Use Vault Agent for automatic token renewal and management, reducing the risk of manual handling errors.
    • Users:
      • Understand that any compromised token grants direct access to Vault, and treat tokens accordingly.

Attack Surface: Misconfiguration of Vault Policies (Granting Excessive Access)

  • Description: Incorrectly configured Vault policies that grant excessive permissions within Vault.
  • How Vault Contributes: This is entirely a Vault-specific risk. Vault's authorization is controlled solely by its policies.
  • Example: A policy intended for a read-only service is accidentally configured to allow write access to a sensitive secrets path.
  • Impact: An attacker who compromises a client with an overly permissive policy can access or modify more secrets within Vault than intended.
  • Risk Severity: High
  • Mitigation Strategies:
    • Developers/Users:
      • Follow the principle of least privilege. Grant only the minimum necessary permissions to each client and user within Vault's policy system.
      • Regularly review and audit Vault policies.
      • Use infrastructure-as-code (IaC) to manage Vault policies and ensure consistency and version control.
      • Implement policy-as-code to enforce security best practices and prevent common misconfigurations.
      • Use Vault's policy templating features to avoid duplication and reduce errors.
      • Thoroughly test policies within a Vault testing environment before deploying them to production.