CVE-2021-42791
📋 TL;DR
This vulnerability in VeridiumID VeridiumAD 2.5.3.0 allows any authenticated user to trigger push notifications for any other user and modify the notification text. If the recipient accepts the notification, the attacker can obtain the victim's login certificate. All organizations using the affected VeridiumAD version are vulnerable.
💻 Affected Systems
- VeridiumID VeridiumAD
📦 What is this software?
Veridiumad by Veridiumid
⚠️ Risk & Real-World Impact
Worst Case
An attacker could obtain login certificates for all users, enabling complete account takeover and lateral movement throughout the organization's authentication system.
Likely Case
Targeted attacks against specific users to steal their credentials and gain unauthorized access to systems protected by VeridiumAD authentication.
If Mitigated
With proper access controls, users can only trigger notifications for themselves, preventing credential theft.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.4.0 or later
Vendor Advisory: https://www.veridiumid.com/security-advisories/
Restart Required: Yes
Instructions:
1. Download the latest VeridiumAD version from Veridium's official portal. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart VeridiumAD services. 5. Verify proper functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to VeridiumAD management interfaces to only authorized administrative users and systems.
Enhanced Monitoring
allImplement alerting for unusual push notification patterns or multiple notification attempts from single users.
🧯 If You Can't Patch
- Implement strict network access controls to limit which users can communicate with VeridiumAD endpoints
- Enable detailed logging and monitoring for push notification requests and investigate any suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check VeridiumAD version in administration console or via 'veridiumad --version' command. If version is 2.5.3.0, system is vulnerable.Check Version:
veridiumad --versionVerify Fix Applied:
After patching, verify version is 2.5.4.0 or later. Test that users can only trigger their own push notifications.📡 Detection & Monitoring
Log Indicators:
- Multiple push notification requests from single user ID
- Push notifications triggered for users other than the requester
- Modified notification text in logs
Network Indicators:
- HTTP POST requests to push notification endpoints with different user IDs in payload
- Unusual frequency of push notification requests
SIEM Query:
source="veridiumad" AND (event="push_notification" AND user_id!=requesting_user_id)🔗 References
- https://www.compass-security.com/en/research/advisories
- https://www.compass-security.com/fileadmin/Research/Advisories/2022_03_CSNC-2021-017_VeridiumId_Broken_Access_Control.txt
- https://www.veridiumid.com/press/veridium-eliminates-passwords-with-veridiumad-for-enterprises-using-microsoft-active-directory/
- https://www.compass-security.com/en/research/advisories
- https://www.compass-security.com/fileadmin/Research/Advisories/2022_03_CSNC-2021-017_VeridiumId_Broken_Access_Control.txt
- https://www.veridiumid.com/press/veridium-eliminates-passwords-with-veridiumad-for-enterprises-using-microsoft-active-directory/
