REDHAT-BUG-2545316: High severity dogtag pki pki-core vulnerability
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. In this scenario, the SSLCLIENTCERT session attribute retains the EST subsystem's own agent certificate instead of being replaced by the end-user's certificate. The parent CMCAuth.verifySignerInfo() then compares the CMC signer's Subject DN against this agent certificate using DER byte comparison, which passes if the attacker crafts a self-signed certificate with a DER-matching Subject DN. The signer certificate's trust chain is not validated — verifySignerInfo() only verifies the CMC message signature against the bundled signer cert's own public key, which trivially passes since the attacker possesses the corresponding private key. Since CMCAuthForEST overrides authenticateCAUser() to skip CA user database verification, and RAHeaderClientCertSubjectNameConstraint sees the agent certificate in SSLCLIENTCERT and allows any subject name for agents, the CA issues a valid certificate with the attacker's requested arbitrary subject. An authenticated EST user with BasicAuth credentials can exploit this to obtain CA-signed certificates impersonating any entity.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the CMCAuthForEST authentication plugin for EST fullcmc enrollment are exposed when requests can be submitted with BasicAuth and without an end-user TLS client certificate.
What does an attacker need to exploit the flaw?
The attacker needs valid EST BasicAuth credentials. They must submit a crafted fullcmc request containing a self-signed signer certificate whose Subject DN DER encoding matches the EST subsystem agent certificate's Subject DN, and possess that certificate's private key.
What is the practical impact of successful exploitation?
A successful attacker can cause the CA to issue a valid certificate for an arbitrary requested subject. The bundled signer certificate's trust chain is not validated in the affected verification path.