Issue summary
In EJBCA versions prior to EJBCA 9.3.4, certificate renewal functionality in the Registration Authority (RA) Web interface does not perform proper authorization checks.
When an end user or client authenticates to the RA Web using a valid client certificate, they can repeatedly invoke the "Renew Client Certificate" function to issue and download new client certificates (.p12 keystores). This occurs even if the user has no administrative privileges or roles on the RA Web, and even if the associated End Entity Profile has Allow Renewal Before Expiration disabled. Furthermore, on the peer API level, certificate self-renewal did not enforce CA-side restrictions on key usages or end entity types.
Who is potentially affected?
Installations where the RA Web interface is accessible to end users or clients authenticated using TLS client certificates.
Installations where self-renewal functionality is accessible via the RA Web interface or Peer API.
Who is not affected?
Installations running EJBCA 9.3.4 or later.
Certificate Authorities (CAs) that have not issued any client certificates.
EJBCA installations where the RA Web UI is not accessible or is disabled.
Severity
Keyfactor rates the issue as having a severity level of low as the vulnerability requires the user to already hold an active, trusted client certificate and only allows renewing certificates for their own existing identity.
Vulnerability Vectors
Missing authorization checks and lack of profile policy enforcement during certificate renewal in the RA Web interface.
How to check if you are affected
You may be affected if you run an EJBCA version prior to 9.3.4 and have client certificate authentication enabled for the RA Web interface. You can check your End Entity Profiles in the Admin GUI to see if you rely on disabling Allow renewal before expiration as an access restriction against RA Web users renewing their certificates.
Mitigation
Upgrade to EJBCA 9.3.4 or later.
Alternatively, prior to upgrade:
Restrict network access to the RA Web interface to trusted administrative networks only.
Disable TLS client certificate authentication on the RA Web port if not required for end-user self-service.
For available deployment options and associated versions, refer to Supported Versions.
Additional information
Should you have any additional questions, please reach out to support@keyfactor.com.
Comments
Article is closed for comments.