Listen to this Post
The CVE-2025-13357 vulnerability stems from an insecure default configuration within the HashiCorp Vault Terraform Provider. The provider’s resource for configuring the LDAP authentication method incorrectly set the `deny_null_bind` parameter to `false` by default. This parameter is critical for security; when enabled, it prevents “null bind” authentication attempts where a client submits a blank password. If the underlying LDAP server is configured to permit unauthenticated or anonymous binds, an attacker could exploit this misconfiguration. By attempting to authenticate with a valid username and a blank password, the LDAP server might grant access, leading to a complete authentication bypass within Vault. The Terraform provider’s failure to enforce a secure default meant that deployments using this resource could be vulnerable without explicit operator intervention to set deny_null_bind = true.
Platform: Terraform Provider
Version: < 5.5.0
Vulnerability: Auth Bypass
Severity: High
date: 2025-11-21
Prediction: Patch 2025-11-28
What Undercode Say:
grep -r "ldap_auth_backend" terraform/ terraform plan -out=tfplan terraform apply tfplan
resource "vault_ldap_auth_backend" "example" {
path = "ldap"
deny_null_bind = true Critical fix
}
How Exploit:
`ldapsearch -x -H ldap://server -b “dc=example” -D “” -w “”`
Protection from this CVE
Upgrade to provider version 5.5.0. Explicitly set `deny_null_bind = true` in all `vault_ldap_auth_backend` resources.
Impact:
Vault Authentication Bypass. Potential Full System Compromise. Information Disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
