OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

## Impact ### ACL Policies OpenBao supports "templated polices": Policies with placeholders that are replaced at evaluation time. This allows you to write a single policy which e.g. grants user "alice" access to all entries in a key value engine prefixed with `alice/` while granting "bob" access to `bob/`, "carol" access to `carol/`, etc. If the data used in the template can be controlled by an attacker (e.g. your system allows the user to freely select their username) and "globbing" characters are considered valid ( e.g. `*` is a valid username) they will be able to escalate their privileges. The problematic characters are `*`, `+` and `/`. ### PKI Secrets Engine `allowed_uri_sans_template` and `allowed_domains` Polices The PKI secrets engine allows you to limit the "common names" a user can requests a TLS certificate for. Similar to the ACL polices this allows you to restrict e.g. "alice" to `alice.example.com`, "bob" to `bob.example.com`, etc. via templates. Again, if an attacker can control this data freely, they can trick the PKI engine into using e.g. the `*.example.com` glob effectively allowing them to issue certificates for any subdomain of `example.com` The problematic character in this case is `*`. ### SSH Secrets Engine `allowed_users` and `allowed_domains` Polices The SSH secrets engine allows you to limit the "principal" a user can request as SSH certificate for. Similar to ACL and PKI, this allows templates. The problematic character in this case is `,` as the