Hashicorp Vault 在 github.com/hashicorp/vault 的插件配置中存在代码执行漏洞

The impact of CVE-2025-6000 is severe. Successful exploitation allows an attacker to execute arbitrary code within the Vault environment, potentially gaining complete control over the system. This could lead to data breaches, unauthorized access to secrets, and complete compromise of the infrastructure relying on Vault for secure storage and management. The ability to execute code via plugin configuration significantly expands the attack surface, as malicious plugins could be crafted or existing plugins exploited to achieve this outcome. This vulnerability shares similarities with other plugin-related vulnerabilities where improper input validation leads to code execution.

Organizations heavily reliant on HashiCorp Vault for secrets management and those utilizing custom or third-party plugins are particularly at risk. Environments with lax plugin configuration controls or those lacking robust input validation are also vulnerable. Shared hosting environments where multiple users can potentially influence Vault configuration pose a heightened risk.

• go / server:

ps aux | grep vault | grep plugin

• go / server:

journalctl -u vault -g "plugin configuration"

• generic web: Check Vault's plugin configuration files for unusual or suspicious code. Review access logs for attempts to load unknown or unauthorized plugins.

1. 2025-08-11Disclosure

   disclosure

1. 已保留2025-06-11
2. 发布日期2025-08-11
3. 修改日期2026-02-04
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-6000 is to upgrade to HashiCorp Vault version 1.20.1 or later. If immediate upgrading is not feasible, consider implementing strict input validation on plugin configurations to prevent malicious code injection. Review all existing plugins for potential vulnerabilities and disable any plugins that are not absolutely necessary. Implement network segmentation to limit the potential blast radius of a successful attack. After upgrading, verify the fix by attempting to load a known malicious plugin configuration and confirming that it is rejected.