Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When restoring a key in transit engine, path is not correctly validated #7663

Closed
byo opened this issue Oct 15, 2019 · 2 comments · Fixed by #7998
Closed

When restoring a key in transit engine, path is not correctly validated #7663

byo opened this issue Oct 15, 2019 · 2 comments · Fixed by #7998
Labels
bug Used to indicate a potential bug secret/transit

Comments

@byo
Copy link

byo commented Oct 15, 2019

Steps to reproduce the behavior:

  1. vault write /transit/keys/test-key type=rsa-2048 exportable=true allow_plaintext_backup=true
  2. vault read --field=backup /transit/backup/test-key | vault write /transit/restore/sub/path/test-key2 backup=-
  3. A key with incorrect path has been created, sub is listed as a sub-path in /transit/keys/ but one can not list that sub-path nor do any operation related to the key

Expected behavior
When doing restore, vault should fail if the name of the key is incorrect.

Environment:

  • Vault Server Version (retrieve with vault status): 1.2.3
  • Vault CLI Version (retrieve with vault version): v1.2.2
  • Server Operating System/Architecture: Debian/amd64

Transit ACLs used:

path "transit/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
@catsby
Copy link
Contributor

catsby commented Dec 10, 2019

I've opened #7998 to address this, hopefully it gets approved and merged 😄

catsby added a commit that referenced this issue Dec 11, 2019
* Add test to verify #7663

* Validate name in transit key restore to not be a path
@catsby
Copy link
Contributor

catsby commented Dec 11, 2019

#7998 was merged, thanks again for reporting this!

briankassouf pushed a commit that referenced this issue Dec 18, 2019
* Add test to verify #7663

* Validate name in transit key restore to not be a path
briankassouf added a commit that referenced this issue Dec 18, 2019
* Output human duration in TTL warnings (#7901)

* Add enable_hostname_label option to telementry stanza (#7902)

* store secret key and value as an object to fix copy/show secret bug (#7926)

* Add accept header check for prometheus mime type (#7958)

* Add accept header check for prometheus mime type

* Fix small header filter bug. Add test

* Fix S3 configurable path handling (#7966)

Also remove some incorrect skipping of the S3 test.

Fixes #7362

* Ui/fix demoting status menu (#7997)

* fix bug where users couldn't click on update primary

* don't show status menu items when cluster isSecondary since those links don't work

* show the mode of replication in the status menu

* do not show server header in status menu when the contents are empty

* show Disaster Recovery instead of 'DR'

* do not show http metrics in status menu unless user is authenticated

* fix typo so icons in status menu show

* Transit: error when restoring to a name that looks like a path (#7998)

* Add test to verify #7663

* Validate name in transit key restore to not be a path

* overwrite bulma bug that crashes safari (#8023)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Used to indicate a potential bug secret/transit
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants