CVE-2024-2048: HashiCorp Vault Auth Bypass Vulnerability

CVE-2024-2048 Overview

Vault and Vault Enterprise ("Vault") TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. This vulnerability affects both HashiCorp Vault and OpenBao implementations.

Critical Impact

This authentication bypass vulnerability allows attackers to craft malicious certificates that can bypass TLS certificate authentication when Vault is misconfigured with non-CA certificates as trusted certificates, potentially granting unauthorized access to secrets and sensitive infrastructure.

Affected Products

• HashiCorp Vault (versions prior to 1.15.5)
• HashiCorp Vault Enterprise (versions prior to 1.14.10)
• OpenBao OpenBao

Discovery Timeline

• 2024-03-04 - CVE-2024-2048 published to NVD
• 2025-11-13 - Last updated in NVD database

Technical Details for CVE-2024-2048

Vulnerability Analysis

This vulnerability is classified under CWE-295 (Improper Certificate Validation). The flaw exists in the TLS certificate authentication method used by Vault when administrators configure a non-CA certificate as a trusted certificate. Under normal operation, certificate validation should verify that client certificates are properly signed by a trusted Certificate Authority (CA). However, when a non-CA certificate is used as the trusted certificate, the validation logic fails to properly verify the certificate chain.

The vulnerability allows an attacker with network access to the Vault instance to craft a malicious client certificate that the flawed validation logic will accept as valid. This effectively enables authentication bypass, granting the attacker access to Vault secrets and operations without possessing legitimate credentials.

Root Cause

The root cause of this vulnerability stems from improper certificate validation logic in Vault's TLS certificate authentication method. When configured with a non-CA certificate as a trusted certificate, the validation routine does not correctly verify that the presented client certificate was actually signed by the trusted certificate. This creates a gap in the authentication chain that can be exploited by presenting a specially crafted certificate.

Attack Vector

The attack can be executed remotely over the network. An attacker targeting a vulnerable Vault instance configured with non-CA certificate authentication would:

1. Identify a Vault instance using TLS certificate authentication with a non-CA trusted certificate
2. Craft a malicious client certificate designed to exploit the validation bypass
3. Present the malicious certificate during the TLS handshake with the Vault server
4. Successfully authenticate to Vault without possessing a legitimately issued certificate
5. Access secrets, policies, and other sensitive data stored within Vault

The vulnerability mechanism involves improper certificate chain validation. When a non-CA certificate is configured as trusted, Vault fails to verify that client certificates were actually signed by this certificate. An attacker can exploit this by creating a self-signed certificate or certificate chain that the faulty validation logic will accept. For detailed technical information, see the HashiCorp Security Advisory.

Detection Methods for CVE-2024-2048

Indicators of Compromise

• Unexpected successful TLS certificate authentication attempts from unknown certificate sources
• Vault audit logs showing authentication events with certificates not issued by your organization's CA
• Unusual access patterns to secrets immediately following certificate-based authentication
• Certificate serial numbers or subject names that don't match your certificate inventory

Detection Strategies

• Review Vault audit logs for all certificate authentication events and verify each certificate against your inventory
• Monitor for authentication attempts using certificates with unexpected or self-signed certificate chains
• Implement certificate pinning monitoring to detect certificates not matching expected fingerprints
• Enable enhanced logging on Vault instances to capture full certificate details during authentication

Monitoring Recommendations

• Configure alerts for certificate-based authentication failures followed by unexpected successes
• Monitor Vault instances for configuration changes to the cert auth method
• Implement continuous validation of cert auth method configuration to detect non-CA certificate usage
• Set up baseline monitoring for normal certificate authentication patterns to detect anomalies

How to Mitigate CVE-2024-2048

Immediate Actions Required

• Upgrade HashiCorp Vault to version 1.15.5 or later immediately
• For Vault Enterprise, upgrade to version 1.14.10 or later
• Audit your cert auth method configuration to identify any non-CA certificates configured as trusted certificates
• Review Vault audit logs for any suspicious authentication activity that may indicate exploitation

Patch Information

HashiCorp has released fixed versions that address this vulnerability. Organizations should upgrade to Vault 1.15.5 or Vault Enterprise 1.14.10 as soon as possible. For additional details on the vulnerability and patching guidance, refer to the HashiCorp Security Advisory HCSEC-2024-05. Additional downstream impact information is available in the NetApp Security Advisory.

Workarounds

• Reconfigure cert auth method to use only proper CA certificates as trusted certificates
• Implement network segmentation to limit access to Vault instances from untrusted networks
• Enable and monitor Vault audit logging to detect potential exploitation attempts
• Consider temporarily disabling cert auth method in favor of alternative authentication methods until patching is complete

# Verify current cert auth method configuration
vault read auth/cert/config

# Check for non-CA certificates in trusted certs
vault list auth/cert/certs

# After upgrading, verify Vault version
vault version
# Expected: Vault v1.15.5 or higher