CVE-2021-32096
📋 TL;DR
CVE-2021-32096 is a Cross-Site Request Forgery (CSRF) vulnerability in NSA Emissary's ConsoleAction component that allows attackers to inject arbitrary Ruby code via the CONSOLE_COMMAND_STRING parameter, leading to remote code execution. This affects Emissary 5.9.0 installations where the console component is accessible. Organizations using vulnerable Emissary deployments for workflow automation are at risk.
💻 Affected Systems
- NSA Emissary
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the Emissary server, executing arbitrary commands, accessing sensitive data, and pivoting to other systems.
Likely Case
Remote code execution leading to data theft, system manipulation, and potential lateral movement within the network.
If Mitigated
Limited impact with proper CSRF protections, input validation, and network segmentation preventing exploitation.
🎯 Exploit Status
Exploitation requires the attacker to trick an authenticated user into visiting a malicious page, but no authentication is needed for the actual code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.10.0 or later
Vendor Advisory: https://github.com/NationalSecurityAgency/emissary/releases
Restart Required: Yes
Instructions:
1. Backup current Emissary installation and data. 2. Download Emissary 5.10.0 or later from official repository. 3. Stop Emissary service. 4. Replace with patched version. 5. Restart Emissary service. 6. Verify functionality.
🔧 Temporary Workarounds
Disable ConsoleAction Component
allRemove or disable the vulnerable ConsoleAction component if not required.
# Edit Emissary configuration to disable ConsoleAction
# Remove or comment out ConsoleAction references in config files
Implement CSRF Protection
allAdd CSRF tokens to all forms and validate them server-side.
# Add CSRF protection middleware to Emissary configuration
# Implement anti-CSRF tokens in web interface
🧯 If You Can't Patch
- Network segmentation: Isolate Emissary servers from internet and restrict access to trusted IPs only.
- Web Application Firewall: Deploy WAF with CSRF protection rules and input validation for Ruby code execution patterns.
🔍 How to Verify
Check if Vulnerable:
Check Emissary version: if running 5.9.0 and ConsoleAction is enabled, system is vulnerable.Check Version:
Check Emissary configuration files or admin interface for version information, or run: `emissary --version` if available.Verify Fix Applied:
Verify version is 5.10.0 or later and test that CONSOLE_COMMAND_STRING parameter no longer accepts arbitrary Ruby code.📡 Detection & Monitoring
Log Indicators:
- Unusual Ruby code execution in logs
- Multiple requests to ConsoleAction endpoint with CONSOLE_COMMAND_STRING parameter
- CSRF token validation failures
Network Indicators:
- POST requests to /console or ConsoleAction endpoints with Ruby code in parameters
- Requests from unexpected sources to administrative interfaces
SIEM Query:
source="emissary.log" AND (CONSOLE_COMMAND_STRING OR eval OR "ruby code")🔗 References
- https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealed
- https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeover
- https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealed
- https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeover
