Listen to this Post
How the Mentioned CVE Works
The vulnerability, CVE-2025-5301, is a privilege escalation flaw within the OpenBao identity group subsystem. A privileged operator, who already possesses specific policy management rights, can exploit the `/identity/groups` API endpoints. By creating a new identity group or modifying an existing one, the attacker can associate a root policy with that group. This root policy grants `sudo` capabilities, which are equivalent to full root permissions for the entire OpenBao system. Consequently, any user or token added to this maliciously configured group inherits these root-equivalent privileges, allowing unauthorized full system control and a complete breach of the privilege separation model.
Platform: OpenBao
Version: <2.4.4
Vulnerability: Privilege Escalation
Severity: High
date: 2025-11-24
Prediction: Patch 2025-11-27
What Undercode Say:
`curl -H “X-Vault-Token: $OPERATOR_TOKEN” -X POST http://openbao:8200/v1/identity/group -d ‘{“name”:”exploit-group”, “policies”:[“root”]}’`
`bao identity group list`
`bao write sys/policies/ssh/root-policy –<<<'{"key": "allow_user_certificates", "value": "true"}'`
How Exploit:
An attacker with `create` or `update` capabilities on the `/identity/group` path creates an identity group linked to the root policy, then adds their own user entity to this group to gain root privileges.
Protection from this CVE
Upgrade to OpenBao 2.4.4. Audit and restrict operator access to the identity subsystem if unused. Implement strict policy management and least privilege principles.
Impact:
Full system root access compromise, complete privilege escalation, and potential for unauthorized data access and system modifications.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
