HuntersHunters
Sign inStart free
Security context
UnratedGO-2024-2508 CVE-2020-35177Published Jun 28, 2024

Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault

Research this vulnerability

Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.

Affected versions

1.5.0 → fixed in 1.5.61.6.0 → fixed in 1.6.1

Details

Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault

The fix

Improve consistency in error messages

catsby· Dec 11, 2020, 08:29 PM+7−2f901a83295
builtin/credential/ldap/backend.go+4 −2
@@ -12,6 +12,8 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 )
  
+const errUserBindFailed = `ldap operation failed: failed to bind as user`
+ 
 func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error) {
 	b := Backend()
 	if err := b.Setup(ctx, conf); err != nil {
@@ -93,7 +95,7 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username stri
 		if b.Logger().IsDebug() {
 			b.Logger().Debug("error getting user bind DN", "error", err)
 		}
-		return nil, logical.ErrorResponse("ldap operation failed: unable to retrieve user bind DN"), nil, nil
+		return nil, logical.ErrorResponse(errUserBindFailed), nil, nil
 	}
  
 	if b.Logger().IsDebug() {
@@ -110,7 +112,7 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username stri
 		if b.Logger().IsDebug() {
 			b.Logger().Debug("ldap bind failed", "error", err)
 		}
-		return nil, logical.ErrorResponse("ldap operation failed: failed to bind as user"), nil, nil
+		return nil, logical.ErrorResponse(errUserBindFailed), nil, nil
 	}
  
 	// We re-bind to the BindDN if it's defined because we assume
 changelog/10537.txt | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 changelog/10537.txt
changelog/10537.txt+3 −0
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/ldap: Improve consistency in error messages
+```

References