CVE-2021-3210
📋 TL;DR
CVE-2021-3210 is a critical remote code execution vulnerability in BloodHound versions up to 4.0.1. Attackers can execute arbitrary system commands by tricking victims into importing malicious data files containing JavaScript payloads in the objectId parameter. This affects all BloodHound users who import data from untrusted sources.
💻 Affected Systems
- BloodHound
📦 What is this software?
Bloodhound by Bloodhound Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the victim's machine, potentially leading to lateral movement across networks and data exfiltration.
Likely Case
Attackers execute commands to establish persistence, steal credentials, or deploy ransomware on individual compromised systems.
If Mitigated
Limited impact with proper network segmentation and endpoint protection blocking malicious payloads.
🎯 Exploit Status
Exploitation requires social engineering to get victim to import malicious file. Proof of concept available in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.2 and later
Vendor Advisory: https://github.com/BloodHoundAD/BloodHound/releases/tag/4.0.2
Restart Required: No
Instructions:
1. Download BloodHound version 4.0.2 or later from official GitHub releases. 2. Replace existing installation with updated version. 3. Verify fix by checking version number.
🔧 Temporary Workarounds
Disable file imports
allPrevent importing of data files to block attack vector
Sandbox execution
linuxRun BloodHound in isolated environment or container
docker run -it --rm bloodhoundad/bloodhound:latest
🧯 If You Can't Patch
- Only import data files from trusted, verified sources
- Run BloodHound on isolated systems with no network connectivity to production environments
🔍 How to Verify
Check if Vulnerable:
Check BloodHound version - if version is 4.0.1 or earlier, system is vulnerable.Check Version:
Check application version in BloodHound UI or installation directoryVerify Fix Applied:
Verify BloodHound version is 4.0.2 or later after update.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from BloodHound executable
- Suspicious command execution patterns
Network Indicators:
- Unexpected outbound connections from BloodHound host
SIEM Query:
Process Creation where Image contains 'bloodhound' AND CommandLine contains suspicious patterns🔗 References
- https://github.com/BloodHoundAD/BloodHound/blob/338e197dc4b7a1ee929c335141172ada5bc80800/src/components/Modals/HelpModal.jsx#L57
- https://github.com/BloodHoundAD/BloodHound/blob/338e197dc4b7a1ee929c335141172ada5bc80800/src/components/Modals/HelpTexts/GenericAll/GenericAll.jsx#L31-L37
- https://github.com/BloodHoundAD/BloodHound/issues/338
- https://github.com/BloodHoundAD/BloodHound/blob/338e197dc4b7a1ee929c335141172ada5bc80800/src/components/Modals/HelpModal.jsx#L57
- https://github.com/BloodHoundAD/BloodHound/blob/338e197dc4b7a1ee929c335141172ada5bc80800/src/components/Modals/HelpTexts/GenericAll/GenericAll.jsx#L31-L37
- https://github.com/BloodHoundAD/BloodHound/issues/338
