CVE-2021-35342
📋 TL;DR
This vulnerability in Mender Enterprise's useradm service allows users to continue accessing the system with their JWT tokens after logout when JWT verification cache is enabled. This affects Mender Enterprise 2.6.x before 2.6.1 and 2.7.x before 2.7.1, potentially allowing unauthorized access to IoT device management systems.
💻 Affected Systems
- Northern.tech Mender Enterprise
📦 What is this software?
Useradm by Northern.tech
Useradm by Northern.tech
⚠️ Risk & Real-World Impact
Worst Case
Former employees or compromised accounts maintain persistent access to IoT device management infrastructure, enabling device manipulation, data exfiltration, or deployment of malicious firmware.
Likely Case
Users who should have been logged out retain access to the management interface, potentially accessing sensitive device information or making unauthorized configuration changes.
If Mitigated
With proper session management and monitoring, impact is limited to temporary unauthorized access until token expiration.
🎯 Exploit Status
Exploitation requires a valid JWT token from a previously authenticated user and JWT verification cache enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Mender Enterprise 2.6.1, 2.7.1
Vendor Advisory: https://mender.io/blog/cve-2021-35342-useradm-logout-vulnerabililty
Restart Required: Yes
Instructions:
1. Upgrade to Mender Enterprise 2.6.1 or 2.7.1. 2. Restart useradm service. 3. Verify JWT verification cache is properly invalidating tokens on logout.
🔧 Temporary Workarounds
Disable JWT verification cache
linuxDisable the JWT verification cache feature to prevent token persistence after logout
Edit useradm configuration to set JWT verification cache to false
🧯 If You Can't Patch
- Implement strict session timeout policies and force periodic re-authentication
- Monitor for unusual access patterns from previously logged-out users
🔍 How to Verify
Check if Vulnerable:
Check Mender Enterprise version and verify if JWT verification cache is enabled in useradm configurationCheck Version:
mender version | grep -i enterpriseVerify Fix Applied:
After patching, test logout functionality and verify tokens become invalid immediately📡 Detection & Monitoring
Log Indicators:
- Multiple successful authentications from same user token after logout events
- Access attempts with expired or revoked tokens
Network Indicators:
- API calls with tokens that should be invalidated
- Unusual access patterns from previously logged-out sessions
SIEM Query:
source="mender" AND (event="logout" OR event="token_invalidation") | stats count by user, token_id