“Secrets and techniques vaults are the spine of digital infrastructure,” the researchers wrote in their report. “They retailer the credentials, tokens, and certificates that govern entry to techniques, providers, APIs, and information. They’re not simply a part of the belief mannequin — they’re the belief mannequin. In different phrases, in case your vault is compromised, your infrastructure is already misplaced.”
HashiCorp Vault and CyberArk Conjur do extra than simply retailer secrets and techniques. They permit organizations to outline insurance policies for accessing and utilizing these secrets and techniques, providing role-based entry controls, automated secrets and techniques rotation, auditing, and extra. Designed for integration with DevOps instruments, these techniques are sometimes a part of CI/CD pipelines.
The assault chains found by Cyata, responsibly disclosed to HashiCorp and CyberArk and now patched, stemmed from delicate logic flaws in authentication, validation, and coverage enforcement mechanisms. The failings enabled lockout bypasses, coverage verify evasion and account impersonation.
