Black Hat USA 2025 | Vaulted Severance: Your Secrets Are Now Outies

Why It Matters

Because Vault protects API keys, certificates, and encryption keys for countless organizations, these authentication and plugin‑loading bypasses give attackers a direct path to compromise the entire secret‑management layer, jeopardizing data integrity and operational security.

Key Takeaways

• Vault authentication can be bypassed using case‑permutation brute force.
• Adding whitespace to LDAP usernames disables MFA enforcement.
• Root token enables loading arbitrary plugins via audit log manipulation.
• Exploiting audit backend reveals plugin directory path for code execution.
• Combining audit prefix and executable flag grants remote code execution.

Summary

The Black Hat USA 2025 talk, titled “Vaulted Severance: Your Secrets Are Now Outies,” examined critical weaknesses in modern secret‑management systems, using HashiCorp Vault as a case study. The presenters, from SIATA, framed the discussion around how vaults serve as the security backbone for enterprises and why their authentication and plugin mechanisms are attractive attack surfaces.

The researchers demonstrated that Vault’s default username‑password lockout can be circumvented by exploiting case‑permutation, effectively multiplying the allowed attempts. A second flaw allows an attacker to append a single whitespace character to an LDAP username, causing the system to skip the MFA challenge entirely. They also showed that possession of the root token grants the ability to load arbitrary plugins, provided several checks—file location, executable flag, directory path, and hash—are bypassed.

Key demos included a live brute‑force using upper‑lower case variations, a whitespace‑based MFA bypass, and a clever abuse of the audit logging backend. By setting a custom log prefix containing a “#!/bin/bash” shebang and marking the audit file as executable, the team injected a malicious script. An error response from a failed plugin load leaked the exact plugin directory, completing the chain to remote code execution.

These findings force enterprises to rethink default Vault configurations: enforce stricter lockout policies, normalize usernames consistently, restrict root‑token usage, and audit the audit‑log feature itself. Failure to remediate could let adversaries exfiltrate credentials, pivot across networks, and gain full control of critical infrastructure.

Original Description

Enterprise vaults are meant to be the last line of defense – the trusted stronghold for your organization's most sensitive assets: secrets, credentials, and encryption keys. But what if the vault itself can be breached remotely – without even logging in?

In this session, we disclose two novel, confirmed remote code execution (RCE) chains affecting the world's most widely adopted vault systems: HashiCorp Vault and CyberArk Conjur.

For the first time, we demonstrate a full RCE chain in HashiCorp Vault, coinciding with its 10-year anniversary. For CyberArk Conjur, we present the kind of pre-auth RCE that keeps admins up at night.

This isn't theoretical. We'll show it live on stage – against default, out-of-the-box configurations. And just as importantly, we'll walk through how these attacks can be detected and prevented – before your secrets become outies.

By:

Shahar Tal | CEO, Cyata Security

Yarden Porat | Core Team Engineer, Cyata Security

Full Session Details Available at:

https://blackhat.com/us-25/briefings/schedule/?#vaulted-severance-your-secrets-are-now-outies-46757