CVE-2021-45102
📋 TL;DR
This vulnerability in HTCondor allows users authenticating with SciTokens to gain unauthorized access beyond their intended permissions. It affects HTCondor installations using SciToken authentication. Organizations running affected versions with SciToken authentication enabled are at risk.
💻 Affected Systems
- HTCondor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain administrative privileges over HTCondor clusters, potentially compromising all jobs and data.
Likely Case
Users could access resources and perform actions beyond their authorized scope, leading to data exposure or job interference.
If Mitigated
With proper network segmentation and monitoring, impact would be limited to specific HTCondor services only.
🎯 Exploit Status
Exploitation requires valid SciToken credentials but minimal technical skill to abuse authorization flaws.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.4 or 9.1.2
Vendor Advisory: https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0004/
Restart Required: Yes
Instructions:
1. Download patched version from HTCondor website. 2. Stop HTCondor services. 3. Install update. 4. Restart HTCondor services. 5. Verify authorization policies are correctly applied.
🔧 Temporary Workarounds
Disable SciToken Authentication
allTemporarily disable SciToken authentication until patching is complete
Modify HTCondor configuration to remove or comment out SciToken authentication settings
Restrict Authorization Policies
allImplement stricter authorization policies for SciToken users
Review and tighten ALLOW and DENY policies in HTCondor configuration files
🧯 If You Can't Patch
- Implement network segmentation to isolate HTCondor services from sensitive systems
- Enable detailed logging and monitoring for SciToken authentication events
🔍 How to Verify
Check if Vulnerable:
Check HTCondor version and SciToken configuration: 'condor_version' and review configuration files for SciToken settingsCheck Version:
condor_versionVerify Fix Applied:
Verify version is 9.0.4+ or 9.1.2+ and test SciToken authorization with limited test tokens📡 Detection & Monitoring
Log Indicators:
- Unexpected authorization successes
- SciToken authentication events with elevated privileges
Network Indicators:
- Unusual API calls from SciToken-authenticated users
- Access patterns exceeding normal user behavior
SIEM Query:
source="htcondor" AND (event="AUTH_SUCCESS" OR event="AUTHORIZATION") AND token_type="scitoken" AND privilege_level="ADMIN"