HashiCorp Vault's AWS IAM authentication method can be
bypassed by sending a serialized request to the STS
AssumeRoleWithWebIdentity method as part of the authentication
flow. The request triggers a JSON encoded response from the STS
server, which can contain a fully-attacker controlled fake
GetCallerIdentityResponse as part of its body. As the Vault
response parser ignores non-xml content before and after the
malicious response, this can be used to spoof arbitrary AWS
identities and roles.
