CVE-2020-35453: 
HashiCorp Vault vulnerability analysis and mitigation

HashiCorp Vault Enterprise's Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. This vulnerability (CVE-2020-35453) was discovered in December 2020 and affected Vault Enterprise versions prior to 1.5.6 and 1.6.1. The issue was fixed with the release of Vault Enterprise versions 1.5.6 and 1.6.1 (Vendor Advisory).

The vulnerability stemmed from incorrect parsing of the supplied path when configuring EGP (Endpoint Governing Policies) policies. This parsing issue allowed policies to process requests in parent and sibling namespaces, which should have been constrained to the namespace in which they were applied or to children namespaces. The vulnerability has a CVSS v3.1 Base Score of 5.3 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability could allow an attacker to apply Sentinel EGP Policies to a global path, potentially enabling them to escalate part of their privileges and influence operations in Vault namespaces that they shouldn't have access to (Vendor Advisory).

The vulnerability requires an attacker to have access to configure Sentinel EGP policies in at least one namespace. The exploit could then be used to affect operations in parent or sibling namespaces, which should normally be restricted (Vendor Advisory).

HashiCorp recommends that customers evaluate the risk associated with this issue and upgrade to Vault Enterprise version 1.5.6, 1.6.1, or newer. The fix ensures that Sentinel EGP policies are properly constrained to their intended namespace scope (Vendor Advisory, Release Notes).