CVE-2021-3551 – CVE-2021-3551 is a credential exposure vulnerab... (How to Fix)

Q: What is the severity of CVE-2021-3551?

CVE-2021-3551 has a CVSS score of 7.8 (HIGH). CVE-2021-3551 is a credential exposure vulnerability in Dogtag PKI-server where the spkispawn command, when run in debug mode, stores admin credentials in installation log files. This allows local attackers to read these logs and obtain admin passwords, potentially gaining administrative privileges to the Dogtag Certificate Authority manager. Systems running Dogtag PKI-server with debug mode enabled are affected.

📋 TL;DR

CVE-2021-3551 is a credential exposure vulnerability in Dogtag PKI-server where the spkispawn command, when run in debug mode, stores admin credentials in installation log files. This allows local attackers to read these logs and obtain admin passwords, potentially gaining administrative privileges to the Dogtag Certificate Authority manager. Systems running Dogtag PKI-server with debug mode enabled are affected.

💻 Affected Systems

Products:

Dogtag PKI-server

Versions: All versions prior to 10.11.3

Operating Systems: Linux

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when spkispawn command is run with debug mode enabled during installation or configuration.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local attacker gains administrative control over Dogtag CA, allowing certificate issuance/revocation, system configuration changes, and potential compromise of the entire PKI infrastructure.

🟠

Likely Case

Local user with file read access obtains admin credentials and gains unauthorized administrative access to the CA manager.

🟢

If Mitigated

Attackers cannot access log files due to proper file permissions, or debug mode is disabled preventing credential logging.

🌐 Internet-Facing: LOW - This requires local access to the system; not directly exploitable over network.

🏢 Internal Only: HIGH - Any local user or process with read access to installation logs can exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access and ability to read installation log files; trivial for users with appropriate file permissions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Dogtag PKI-server 10.11.3 and later

Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1959971

Restart Required: Yes

Instructions:

1. Update Dogtag PKI-server to version 10.11.3 or later. 2. Restart the PKI-server service. 3. Remove any existing installation log files containing credentials.

🔧 Temporary Workarounds

Disable debug mode and secure log files

linux

Prevent credential logging by disabling debug mode and restrict access to existing log files

chmod 600 /var/log/pki/installation/*.log
chown root:root /var/log/pki/installation/*.log

🧯 If You Can't Patch

Ensure installation log files have restrictive permissions (600) and are owned by root
Audit and remove any existing log files containing credentials from previous installations

🔍 How to Verify

Check if Vulnerable:

Check if Dogtag PKI-server version is below 10.11.3 and review installation logs for credential exposure

Check Version:

pki-server --version

Verify Fix Applied:

Verify Dogtag PKI-server version is 10.11.3 or later and check that debug mode is not enabled during operations

📡 Detection & Monitoring

Log Indicators:

Unauthorized access attempts to installation log files
Admin credential strings appearing in log analysis

Network Indicators:

Unusual administrative activity from non-admin users

SIEM Query:

source="/var/log/pki/installation/" AND (event="read" OR event="access") AND user!="root"

📊 Metadata

CVE ID: CVE-2021-3551

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-312

Published: February 16, 2022

Last Updated: November 21, 2024

🔗 References

https://bugzilla.redhat.com/show_bug.cgi?id=1959971 Issue Tracking,Patch,Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1959971 Issue Tracking,Patch,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-3551, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Dogtagpki by Dogtagpki

Enterprise Linux by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux For Ibm Z Systems by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Power Little Endian by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Update Services For Sap Solutions by Redhat

Fedora by Fedoraproject