CVE-2023-0620: HashiCorp Vault SQLI Vulnerability

CVE-2023-0620 Overview

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 contain an SQL injection vulnerability in the Microsoft SQL (MSSQL) Database Storage Backend configuration. When configuring the MSSQL plugin through the local configuration file, certain parameters are not properly sanitized before being passed to the user-provided MSSQL database. This allows an attacker with high privileges to modify these parameters and execute malicious SQL commands against the database backend.

Critical Impact

Attackers with local access and high privileges can exploit this SQL injection flaw to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability of the Vault storage backend.

Affected Products

• HashiCorp Vault versions 0.8.0 through 1.13.0
• HashiCorp Vault Enterprise versions 0.8.0 through 1.13.0
• Any deployment using Microsoft SQL Database Storage Backend

Discovery Timeline

• 2023-03-30 - CVE-2023-0620 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-0620

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in the MSSQL Database Storage Backend configuration component of HashiCorp Vault. The flaw stems from improper input validation when processing configuration parameters for the MSSQL plugin. When administrators configure Vault to use Microsoft SQL Server as a storage backend, certain configuration parameters are passed directly to database queries without adequate sanitization.

The vulnerability requires local access and high privileges to exploit, which limits the attack surface but still poses significant risk in environments where administrative access to Vault configuration is shared or compromised. Successful exploitation could allow an attacker to read, modify, or delete data within the MSSQL database, potentially compromising secrets stored in Vault.

Root Cause

The root cause of this vulnerability is insufficient input sanitization in the MSSQL storage backend plugin. When processing configuration file parameters for the Microsoft SQL database connection, the application fails to properly escape or parameterize user-supplied values before incorporating them into SQL queries. This classic SQL injection pattern allows specially crafted input to break out of the intended query context and execute arbitrary SQL commands.

Attack Vector

The attack vector is local, requiring the attacker to have access to the Vault configuration file and elevated privileges within the system. The attacker must be able to modify the MSSQL storage backend configuration parameters. By injecting malicious SQL syntax into vulnerable configuration parameters, the attacker can manipulate database queries executed during Vault initialization or operation.

The vulnerability is exploited during the configuration phase of the MSSQL storage backend. An attacker with write access to the Vault configuration file can inject SQL commands through unsanitized parameters. When Vault processes these configuration values and connects to the MSSQL database, the injected SQL code executes with the privileges of the database connection.

Detection Methods for CVE-2023-0620

Indicators of Compromise

• Unusual or malformed entries in Vault configuration files, particularly in MSSQL storage backend sections
• Unexpected SQL queries or commands in MSSQL database audit logs
• Unauthorized data access or modifications in the Vault storage database
• Configuration file changes outside of normal change management processes

Detection Strategies

• Monitor Vault configuration files for unauthorized modifications using file integrity monitoring (FIM)
• Enable and review MSSQL database audit logs for anomalous query patterns or SQL injection signatures
• Implement configuration management tools to detect drift from approved Vault configurations
• Review Vault audit logs for unusual storage backend initialization events

Monitoring Recommendations

• Deploy SentinelOne agents on systems hosting Vault servers to detect configuration tampering
• Configure alerting for any modifications to Vault configuration files in production environments
• Enable SQL Server extended events or audit features to capture and analyze database queries
• Implement centralized logging for Vault servers and correlate with database activity

How to Mitigate CVE-2023-0620

Immediate Actions Required

• Upgrade HashiCorp Vault to version 1.13.1, 1.12.5, or 1.11.9 or later immediately
• Audit Vault configuration files for any signs of tampering or malicious SQL injection attempts
• Review MSSQL database logs for evidence of exploitation
• Restrict access to Vault configuration files to only essential personnel

Patch Information

HashiCorp has released patched versions that address this SQL injection vulnerability. Organizations should upgrade to one of the following fixed versions:

• Vault 1.13.1 (for users on 1.13.x branch)
• Vault 1.12.5 (for users on 1.12.x branch)
• Vault 1.11.9 (for users on 1.11.x branch)

For detailed patch information and upgrade instructions, refer to the HashiCorp Vault Security Advisory. Additional context is available in the NetApp Security Advisory NTAP-20230526-0008.

Workarounds

• Implement strict file system permissions on Vault configuration files to prevent unauthorized modifications
• Consider using an alternative storage backend (such as Consul, Raft integrated storage, or other supported backends) until patching is complete
• Apply network segmentation to limit access between Vault servers and the MSSQL database
• Enable enhanced monitoring and alerting on configuration file changes and database query patterns

# Restrict Vault configuration file permissions
chmod 600 /etc/vault.d/vault.hcl
chown vault:vault /etc/vault.d/vault.hcl

# Verify current Vault version
vault version

# Example upgrade process (backup first)
# Consult HashiCorp documentation for your specific deployment method