CVE-2020-35177

Vulnerability

Details

CVE-2020-35177 is an information disclosure vulnerability in HashiCorp Vault and Vault Enterprise versions 1.4.1 and newer. The LDAP authentication method returned distinct error messages for valid and invalid usernames, enabling an attacker to enumerate valid LDAP users [1][3]. This behavior was introduced in Vault 1.4.1 and persisted until the fix [3].

Exploitation

An attacker with network access to the Vault API can send authentication requests to the LDAP auth endpoint with different usernames. By analyzing the error messages returned, the attacker can determine whether a given username exists in the LDAP directory [3]. No prior authentication is required to perform this enumeration.

Impact

User enumeration allows an attacker to build a list of valid usernames, which can be leveraged for further attacks such as password spraying, credential stuffing, or targeted social engineering [3]. While the vulnerability does not directly expose credentials, it reduces the attack surface for subsequent brute-force or phishing campaigns.

Mitigation

HashiCorp addressed the issue by improving the consistency of error messages in the LDAP auth method [4]. The fix is included in Vault and Vault Enterprise versions 1.5.6 and 1.6.1 [2][3]. Users running affected versions should upgrade immediately. No workarounds are documented; upgrading is the recommended remediation.