CVE-2021-28248
📋 TL;DR
CVE-2021-28248 allows attackers to perform unlimited authentication attempts against CA eHealth Performance Manager web interface, enabling brute-force attacks to guess valid credentials. This affects organizations running unsupported versions of the software, leaving them vulnerable to account takeover.
💻 Affected Systems
- CA eHealth Performance Manager
📦 What is this software?
Ehealth by Broadcom
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of administrative accounts leading to full system control, data exfiltration, and potential lateral movement within the network.
Likely Case
Unauthorized access to user accounts with varying privilege levels, potentially leading to data exposure and limited system manipulation.
If Mitigated
Failed authentication attempts logged but no successful account compromise due to rate limiting or account lockout policies.
🎯 Exploit Status
Simple HTTP POST requests to /web/frames/ endpoint with different passwords. Attack requires no authentication and uses common brute-force tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None - product is end-of-life
Vendor Advisory: None available - product unsupported
Restart Required: No
Instructions:
No official patch available. Consider upgrading to supported alternatives or implementing compensating controls.
🔧 Temporary Workarounds
Implement Web Application Firewall (WAF) Rules
allConfigure WAF to rate-limit requests to /web/frames/ endpoint and block excessive authentication attempts.
Network Segmentation
allRestrict access to eHealth Performance Manager web interface to trusted networks only.
🧯 If You Can't Patch
- Implement strong password policies and multi-factor authentication if supported
- Monitor authentication logs for brute-force patterns and implement account lockout policies
🔍 How to Verify
Check if Vulnerable:
Check if CA eHealth Performance Manager version is 6.3.2.12 or earlier. Attempt multiple authentication requests to /web/frames/ endpoint and verify if they're all accepted.Check Version:
Check application version in web interface or consult installation documentation.Verify Fix Applied:
Since no patch exists, verify workarounds by testing rate limiting and access restrictions.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts from single IP address
- Rapid succession of POST requests to /web/frames/
Network Indicators:
- High volume of HTTP POST requests to authentication endpoint
- Traffic patterns matching brute-force tools
SIEM Query:
source="ehealth_logs" AND (url_path="/web/frames/" AND http_method="POST") | stats count by src_ip | where count > 10