-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the vault/identity_store_groups.go file, specifically within the IdentityStore.handleGroupUpdateCommon function. This function is responsible for updating identity groups. The core of the issue is improper handling of policy name casing. A privileged operator could assign a root policy to an identity group by using a different case variation (e.g., "Root", "rOoT"). The original code used a function (strutil.RemoveDuplicatesStable) that performed case-insensitive comparisons for duplicates but preserved the original casing. This allowed the mixed-case "root" policy to bypass a security check that was explicitly looking for the lowercase "root" string. However, the policy would still be treated as a root policy by the system, leading to privilege escalation. The patch addresses this by replacing the faulty function with strutil.RemoveDuplicates, which normalizes all policy names to lowercase, ensuring that any variation of the "root" policy is caught by the security check. The vulnerability is confined to the identity group update logic, and the identified function is the central point where this logic is executed.
IdentityStore.handleGroupUpdateCommonvault/identity_store_groups.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openbao/openbao | go | < 2.4.4 | 2.4.4 |