Описание
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.
Отчет
Red Hat rates this Moderate because exploitation is limited to HTTP GET requests (no integrity impact), the attacker cannot read internal responses on production-supported backends (low confidentiality impact), and the ACME responder must be explicitly deployed. The Scope is Changed (S:C) because the ACME responder causes the Dogtag server to make outbound requests to services outside its own trust boundary, but the actual information gained on supported configurations is limited to network topology probing. While the SSRF is GET-only and does not directly allow data modification, administrators should be aware that internal services reachable from the Dogtag host which perform actions on HTTP GET (such as cloud instance metadata endpoints that issue temporary credentials) could be indirectly affected.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Certificate System 10 | redhat-pki:10/redhat-pki | Fix deferred | ||
| Red Hat Certificate System 11 | redhat-pki | Fix deferred | ||
| Red Hat Certificate System 9 | pki-core | Fix deferred | ||
| Red Hat Certificate System 9 | redhat-pki | Fix deferred | ||
| Red Hat Enterprise Linux 10 | dogtag-pki | Fix deferred | ||
| Red Hat Enterprise Linux 6 | pki-core | Fix deferred | ||
| Red Hat Enterprise Linux 7 | pki-core | Fix deferred | ||
| Red Hat Enterprise Linux 8 | pki-core:10.6/pki-core | Fix deferred | ||
| Red Hat Enterprise Linux 9 | pki-core | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.8 Medium
CVSS3
Связанные уязвимости
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 chal ...
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.
EPSS
5.8 Medium
CVSS3