GHSA-2464-8j7c-4cjm
ADVISORY - githubSummary
Summary
Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.
Details
OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure as follows:
_, _, err := d.getPrimitive(field, schema)
if err != nil {
return fmt.Errorf("error converting input for field %q: %w", field, err)
}
where this calls mapstructure.WeakDecode(...): https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193
func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
raw, ok := d.Raw[k]
if !ok {
return nil, false, nil
}
switch t := schema.Type; t {
case TypeBool:
var result bool
if err := mapstructure.WeakDecode(raw, &result); err != nil {
return nil, false, err
}
return result, true, nil
Notably, WeakDecode(...) eventually calls one of the decode helpers, which surfaces the original value via strconv helpers:
& more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.
PoC
To reproduce with OpenBao:
$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
and in a new tab:
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf"
--> server logs:
2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\""
Impact
This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at '' expected a map, got 'string' -- when the field type is string and a map is provided, we see the above information leak -- the previous example had a map type field with a string value provided).
This was rated 4.5 Medium by HashiCorp in the past iteration.
Common Weakness Enumeration (CWE)
Improper Output Neutralization for Logs
GitHub
1.6
CVSS SCORE
5.3mediumGoLang
-
Chainguard
CGA-3rqw-vj7x-v62r
-
Chainguard
CGA-3vpm-cw8g-rg54
-
Chainguard
CGA-4q4f-94qf-6mjp
-
Chainguard
CGA-5m26-33pv-2cw9
-
Chainguard
CGA-5pc9-v7hr-339h
-
Chainguard
CGA-5ph7-x328-jxvm
-
Chainguard
CGA-5v36-54w6-p693
-
Chainguard
CGA-68ff-v9c9-6p3m
-
Chainguard
CGA-6v7g-pgfj-9pch
-
Chainguard
CGA-6v98-ffvr-7w2j
-
Chainguard
CGA-6v9x-4fpg-qcpm
-
Chainguard
CGA-6xw7-8mxr-f65x
-
Chainguard
CGA-7fv6-65pq-qv9p
-
Chainguard
CGA-7rvr-gx3f-frcq
-
Chainguard
CGA-872g-3x57-7f97
-
Chainguard
CGA-886w-gxw7-3w63
-
Chainguard
CGA-8gxh-xjf6-6g44
-
Chainguard
CGA-8prq-r647-jm6w
-
Chainguard
CGA-9cc7-9vxj-99vq
-
Chainguard
CGA-fgwq-pff2-92m4
-
Chainguard
CGA-gxmp-7338-3v53
-
Chainguard
CGA-h2mc-cjrm-pxx6
-
Chainguard
CGA-h6fh-qwgq-fh98
-
Chainguard
CGA-hjhx-57vj-83gw
-
Chainguard
CGA-jwv9-p9fh-cxxj
-
Chainguard
CGA-m2x7-j5rv-j9wf
-
Chainguard
CGA-m3qf-6w64-gqqg
-
Chainguard
CGA-m7c3-9pm2-j6ff
-
Chainguard
CGA-p4c9-wmm4-wqhr
-
Chainguard
CGA-p4fr-j842-fw8c
-
Chainguard
CGA-p78m-xg2j-c2r7
-
Chainguard
CGA-ph8x-4gxj-82wj
-
Chainguard
CGA-qj55-9pjx-f47q
-
Chainguard
CGA-r2m4-m6cq-wjm4
-
Chainguard
CGA-r5r8-8vw8-42jg
-
Chainguard
CGA-r8vg-337h-7jrm
-
Chainguard
CGA-r9vr-vqfv-2xw5
-
Chainguard
CGA-rr79-8598-c647
-
Chainguard
CGA-v846-fp5f-333w
-
Chainguard
CGA-vcm3-8fw4-666g
-
Chainguard
CGA-wh6f-hggg-rq2m
-
Chainguard
CGA-whp6-gf2q-w8mf
-
Chainguard
CGA-wxwg-9qqc-6mj9
-
minimos
MINI-2vmc-8jjw-9qj4
-
minimos
MINI-392m-xq36-j4fr
-
minimos
MINI-4939-cgp2-4236
-
minimos
MINI-5fg3-8gxc-vq97
-
minimos
MINI-64h6-mvqj-3p8w
-
minimos
MINI-6fx5-m9gw-5wgw
-
minimos
MINI-6gwh-fwvg-c73m
-
minimos
MINI-6hx6-9vqf-9cq7
-
minimos
MINI-6px9-4cgf-vgmr
-
minimos
MINI-6r5x-7qh8-75hm
-
minimos
MINI-6xxv-j95c-qxmf
-
minimos
MINI-73p7-73gm-m446
-
minimos
MINI-76hv-qh68-94xv
-
minimos
MINI-78f5-mhqm-mh88
-
minimos
MINI-7rrc-q22r-24jj
-
minimos
MINI-7v3w-436q-2jq7
-
minimos
MINI-8876-qmhx-3886
-
minimos
MINI-8jrx-6m9h-wqhh
-
minimos
MINI-94g9-8vgp-hm4r
-
minimos
MINI-969q-q5gw-2jp7
-
minimos
MINI-9wgp-9f78-wh2q
-
minimos
MINI-cggw-ffp4-g365
-
minimos
MINI-gff9-m658-67hh
-
minimos
MINI-gvhm-gpr8-9w4p
-
minimos
MINI-hp6p-2p6p-g7fv
-
minimos
MINI-j893-6jw5-7p6q
-
minimos
MINI-jc8p-mgcq-746h
-
minimos
MINI-m7xw-74qg-7mwh
-
minimos
MINI-p2j9-856r-gxwm
-
minimos
MINI-pp8h-8cgx-5546
-
minimos
MINI-pvq6-2pjv-4rgc
-
minimos
MINI-q482-872j-m7ww
-
minimos
MINI-q925-x3x7-qhv5
-
minimos
MINI-qw33-xx4p-4pmv
-
minimos
MINI-r3p9-4j42-c5c4
-
minimos
MINI-r984-3mqv-j4gx
-
minimos
MINI-rmqj-3mpj-26jr
-
minimos
MINI-v94q-xp73-8r22
-
minimos
MINI-vm6r-99vq-7p4r
-
minimos
MINI-wc3m-pxwc-588g
-
minimos
MINI-wg38-q742-wf9h
-
minimos
MINI-whww-5x2g-3pc6
-
minimos
MINI-wxcq-5w8p-4m7m
-
minimos
MINI-xxjx-5m79-7q7h
-
minimos
MINI-xxx9-ff9v-3qc5
-