=====================================================================

                             CERT-Renater

                   Note d'Information No. 2021/VULN662
_____________________________________________________________________

DATE                : 17/12/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running vault-cli (pip) versions prior to
                                            3.0.0.

=====================================================================
https://github.com/peopledoc/vault-cli/security/advisories/GHSA-q34h-97wf-8r8j
_____________________________________________________________________

vault-cli: possible RCE when reading user-defined data

high
ewjoachim published GHSA-q34h-97wf-8r8j Dec 16, 2021

Package
vault-cli (pip)

Affected versions
 >=0.7.0,<3.0.0

Patched versions
3.0.0


Description

Impact

What kind of vulnerability is it? Who is impacted?

vault-cli features the ability for rendering templated values (as
explained in the documentation). When a secret starts with the prefix
!template!, vault-cli interprets the rest of the contents of the secret
as a Jinja2 template.
Jinja2 is a powerful templating engine and it's not designed to safely
render arbitrary templates. An attacker controlling a jinja2 template
rendered on a machine can trigger arbitrary code, making this a Remote
Code Execution (RCE) risk.
If the content of the vault can be completely trusted, then this is not
a problem. Otherwise, if your threat model includes cases where an
attacker can manipulate a secret value read from the vault using
vault-cli, then this vulnerability may impact you.

This does not impact vault itself, except for the fact that the
attacker, having an RCE on the machine that executes vault-cli, may
abuse the token that vault-cli uses, to read, write or delete other data
from the vault.


Patches

Has the problem been patched? What versions should users upgrade to?

In 3.0.0, the code related to interpreting vault templated secrets has
been removed entirely.


Workarounds

Is there a way for users to fix or remediate the vulnerability without
upgrading?

Using the environment variable VAULT_CLI_RENDER=false or the
flag --no-render (placed between vault-cli and the subcommand, e.g.
vault-cli --no-render get-all) or adding render: false to the vault-cli
configuration yaml file disables rendering and removes the
vulnerability.


Using the python library, you can use: 
vault_cli.get_client(render=False) when creating your client to get a
client that will not render templated secrets and thus operates
securely.


References

Are there any links users can visit to find out more?

Here's an article explaining how jinja2 templates might be exploited to
have side effects:
https://podalirius.net/en/publications/grehack-2021-optimizing-ssti-payloads-for-jinja2/


For more information

If you have any questions or comments about this advisory:

     Open an issue in the vault-cli repo


CVE ID
CVE-2021-43837

CVSS Score
8.4 High

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H


Credits

     @ewjoachim ewjoachim Joachim Jablon



=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================