CVE-2021-28250
📋 TL;DR
CVE-2021-28250 is a privilege escalation vulnerability in CA eHealth Performance Manager where the runpicEhealth executable improperly handles setuid/setgid files, allowing local attackers to execute arbitrary code with elevated ehealth user privileges. This affects all versions through 6.3.2.12, but only impacts systems running unsupported versions since the product is no longer maintained.
💻 Affected Systems
- CA eHealth Performance Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full control of the system as ehealth user, potentially leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Local user with shell access escalates privileges to ehealth user, gaining access to sensitive performance monitoring data and system resources.
If Mitigated
Attack limited to users with local shell access, unable to affect properly segmented systems or those with strict user privilege separation.
🎯 Exploit Status
Exploitation requires local shell access. The vulnerability is well-documented with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available since product is end-of-life. Consider migration to supported alternatives.
🔧 Temporary Workarounds
Remove setuid bit from runpicEhealth
linuxRemove the setuid permission from the vulnerable executable to prevent privilege escalation
chmod u-s /path/to/runpicEhealth
Restrict file permissions
linuxLimit access to the runpicEhealth executable to only necessary users
chmod 750 /path/to/runpicEhealth
chown root:root /path/to/runpicEhealth
🧯 If You Can't Patch
- Isolate affected systems in separate network segments with strict access controls
- Implement principle of least privilege - ensure users only have necessary shell access
🔍 How to Verify
Check if Vulnerable:
Check if runpicEhealth executable has setuid bit set: ls -la /path/to/runpicEhealth | grep '^...s'Check Version:
Check eHealth version in product documentation or configuration filesVerify Fix Applied:
Verify setuid bit is removed: ls -la /path/to/runpicEhealth | grep -v '^...s'📡 Detection & Monitoring
Log Indicators:
- Unusual process execution as ehealth user
- Failed privilege escalation attempts in system logs
Network Indicators:
- N/A - local exploitation only
SIEM Query:
process.name:"runpicEhealth" AND user.name!="ehealth"