ACME Service State Bypass in Dogtag PKI

Executive Summary

This vulnerability is in Dogtag PKI's ACME responder where admin-only endpoints use exact URL matching in security constraints. By adding a trailing slash to the URL, attackers bypass authentication while the request still reaches the handler, allowing unauthorized toggling of ACME service state including denial of service.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to Dogtag PKI ACME endpoints by monitoring requests to /v1/enable/ and /v1/disable/. Use network logs to detect unusual POST requests to these paths with trailing slashes. Inspect Tomcat and RESTEasy logs for authentication bypass attempts.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated attacker could enable or disable ACME services remotely, causing persistent denial of service by disabling the service or re-enabling one that was intentionally disabled. This could disrupt certificate issuance and management.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized access to administrative functions that control ACME service state. Unauthenticated attackers could disable services, potentially disrupting security-related operations. For GDPR, this may affect integrity of security measures. For HIPAA, it could compromise availability of critical PKI services.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest patches from Red Hat for Dogtag PKI. Temporarily restrict access to ACME endpoints via firewall rules. Review and update web.xml security constraints to enforce proper path matching. Monitor for unauthorized service state changes.

Useful 0 Not Useful 0