CVE-2021-35001
📋 TL;DR
This vulnerability in BMC Track-It! allows authenticated attackers to access sensitive information through the GetData endpoint due to missing authorization checks. Attackers can exploit this to disclose stored credentials, potentially leading to further system compromise. Organizations using vulnerable versions of BMC Track-It! are affected.
💻 Affected Systems
- BMC Track-It!
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative credentials, leading to complete system takeover, data exfiltration, and lateral movement across the network.
Likely Case
Attackers access sensitive configuration data or user credentials, enabling privilege escalation and limited system compromise.
If Mitigated
With proper network segmentation and monitoring, impact is limited to credential disclosure requiring additional steps for exploitation.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authentication is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references, but patches are available according to vendor advisories
Vendor Advisory: https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It
Restart Required: Yes
Instructions:
1. Review BMC security advisory for specific patch version
2. Download appropriate patch from BMC support portal
3. Apply patch following BMC installation instructions
4. Restart Track-It! services
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to Track-It! application to authorized users only
Authentication Hardening
allImplement strong authentication policies and monitor for suspicious authentication attempts
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Track-It! servers from critical systems
- Enable detailed logging and monitoring of GetData endpoint access patterns
🔍 How to Verify
Check if Vulnerable:
Check Track-It! version against BMC security advisory for vulnerable versionsCheck Version:
Check Track-It! administration console or application properties for version informationVerify Fix Applied:
Verify patch installation and confirm version is updated beyond vulnerable versions📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to GetData endpoint
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- Unusual traffic to Track-It! application from unexpected sources
SIEM Query:
source="track-it" AND (endpoint="GetData" OR endpoint="*GetData*") AND status=200 | stats count by src_ip, user