CVE-2021-36205 – CVE-2021-36205 is an authentication bypass vuln... (How to Fix)

Q: What is the severity of CVE-2021-36205?

CVE-2021-36205 has a CVSS score of 8.1 (HIGH). CVE-2021-36205 is an authentication bypass vulnerability in Johnson Controls Metasys products where session tokens are not properly cleared on logout. This allows attackers to reuse valid session tokens to gain unauthorized access to building management systems. Affected organizations include those using Johnson Controls Metasys for building automation and control.

📋 TL;DR

CVE-2021-36205 is an authentication bypass vulnerability in Johnson Controls Metasys products where session tokens are not properly cleared on logout. This allows attackers to reuse valid session tokens to gain unauthorized access to building management systems. Affected organizations include those using Johnson Controls Metasys for building automation and control.

💻 Affected Systems

Products:

Johnson Controls Metasys
Johnson Controls C•CURE 9000
Johnson Controls Facility Explorer

Versions: Multiple versions prior to specific patches - check vendor advisory for exact ranges

Operating Systems: Windows-based systems running Metasys applications

Default Config Vulnerable: ⚠️ Yes

Notes: Affects web interfaces and API endpoints of the listed building management systems.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain persistent administrative access to building management systems, enabling physical security bypass, environmental manipulation, and disruption of critical infrastructure operations.

🟠

Likely Case

Unauthorized users access building control interfaces to modify temperature settings, lighting, access controls, or view sensitive system information.

🟢

If Mitigated

Limited impact with proper network segmentation, monitoring, and compensating controls preventing token reuse from being useful.

🌐 Internet-Facing: HIGH - If exposed to internet, attackers can easily exploit this to gain unauthorized access to building systems.

🏢 Internal Only: MEDIUM - Internal attackers or compromised accounts could exploit this, but requires some level of network access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires obtaining a valid session token through legitimate login or other means, then reusing it after logout.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple version-specific patches - refer to Johnson Controls security advisories

Vendor Advisory: https://www.johnsoncontrols.com/cyber-solutions/security-advisories

Restart Required: Yes

Instructions:

1. Review Johnson Controls security advisory ICSA-22-104-02. 2. Identify affected product versions. 3. Apply vendor-provided patches. 4. Restart affected services/systems. 5. Verify session token clearing functionality.

🔧 Temporary Workarounds

Session Timeout Reduction

all

Reduce session timeout values to limit window for token reuse

Configure in Metasys application settings - refer to product documentation

Network Segmentation

all

Isolate building management systems from general corporate networks

Implement firewall rules to restrict access to Metasys interfaces

🧯 If You Can't Patch

Implement strict network access controls to limit who can reach the affected systems
Enable detailed logging and monitoring for unusual session activity and token reuse patterns

🔍 How to Verify

Check if Vulnerable:

Test logout functionality: 1. Log into system. 2. Capture session token. 3. Log out. 4. Attempt to reuse same token in API/web requests. If successful, system is vulnerable.

Check Version:

Check Metasys/C•CURE version through application interface or consult system documentation

Verify Fix Applied:

Repeat vulnerability test - after logout, session tokens should be invalidated and not reusable.

📡 Detection & Monitoring

Log Indicators:

Multiple successful logins from same token after logout events
Session tokens being used from unexpected IP addresses after logout

Network Indicators:

API/web requests with previously used session tokens
Unusual authentication patterns to building management endpoints

SIEM Query:

source="metasys" AND (event="logout" OR event="session_end") FOLLOWED BY source="metasys" AND event="api_request" WITH SAME session_id

📊 Metadata

CVE ID: CVE-2021-36205

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-459

Published: April 15, 2022

Last Updated: November 21, 2024

🔗 References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-02 Third Party Advisory,US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisories Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-02 Third Party Advisory,US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisories Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-36205, you might also want to check these: