Hashicorp Vault Community, Incorrect Authorization, CVE-2025-XXXX (Moderate)

The vulnerability (CVE-2025-XXXX) in Hashicorp Vault Community and Enterprise arises due to improper validation of Azure-issued JWT tokens in the Azure Auth method. Specifically, the `bound_locations` parameter, which enforces location-based access control, can be bypassed due to insufficient claims verification. Attackers exploiting this flaw can authenticate without meeting the required geographical restrictions, leading to unauthorized access.
The issue stems from Vault failing to properly check the `aud` (audience) claim and other token attributes, allowing manipulated tokens to bypass security checks. This affects versions 1.10.0 through 1.19.0. Patches were released in Vault 1.19.1 (Community/Enterprise) and backported to older supported versions.

DailyCVE Form:

Platform: Hashicorp Vault
Version: 1.10.0-1.19.0
Vulnerability: Auth Bypass
Severity: Moderate
Date: May 2, 2025

What Undercode Say:

Exploitation:

Craft a malicious Azure JWT token with invalid bound_locations.

Use `curl` to send the token to Vault’s `/v1/auth/azure/login` endpoint:

curl -X POST -d '{"jwt":"MALICIOUS_TOKEN"}' http://vault-server/v1/auth/azure/login

If successful, the attacker gains a Vault token with unintended permissions.

Mitigation:

Upgrade to Vault 1.19.1 or apply backported patches.

2. Enforce strict JWT validation in `vault.hcl`:

auth "azure" {
bound_locations = ["allowed-region"]
validate_claims = true
}

3. Monitor logs for suspicious Azure auth attempts:

vault audit-enable file file_path=/var/log/vault_audit.log

Detection:

Check for unpatched versions:
```
vault version
```

Scan for anomalous login patterns:

grep "azure/login" /var/log/vault_audit.log | jq '.request.jwt'