Certificate Revocation Bypass in etcd

Executive Summary

This vulnerability exists in etcd versions prior to 3.5.32 and 3.6.13 when it is configured to split HTTP and gRPC client endpoints onto separate listeners using the --listen-client-http-urls option. In this configuration, the --client-crl-file, which is supposed to enforce a Certificate Revocation List (CRL), is not enforced on the gRPC listener. As a result, a client with a revoked certificate can still authenticate successfully over gRPC.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows clients with revoked certificates to authenticate successfully over the gRPC listener. This can lead to unauthorized access to the etcd distributed key-value store, potentially compromising the confidentiality and integrity of the data stored within the system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade your etcd installation to version 3.5.32 or 3.6.13 or later, where the issue is fixed.

Ensure that when configuring etcd with --listen-client-http-urls to split HTTP and gRPC client endpoints, the --client-crl-file Certificate Revocation List enforcement applies to both listeners.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the bypass of Certificate Revocation List (CRL) enforcement on the gRPC listener in etcd when HTTP and gRPC client endpoints are separated. Detection involves verifying whether your etcd deployment enforces CRL checks on gRPC connections.

To detect if your system is vulnerable, you can check the etcd version and configuration:

• Check the etcd version to ensure it is 3.5.32 or later, or 3.6.13 or later, where the fix is applied.
• Verify if etcd is configured with the --listen-client-http-urls flag to split HTTP and gRPC endpoints.
• Check if the --client-crl-file flag is set and whether the CRL file is properly enforced on the gRPC listener.

Suggested commands to help detect the vulnerability or verify the fix:

• Check etcd version: `etcd --version` or `etcdctl version`
• Inspect running etcd process for flags: `ps aux | grep etcd` and look for `--listen-client-http-urls` and `--client-crl-file` options.
• Test client certificate authentication over gRPC with a revoked certificate to see if it is rejected (requires setup of revoked cert and test client).

As a temporary workaround, network-level restrictions such as firewall rules can be used to limit access to etcd client ports, but this does not replace proper CRL enforcement.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a client with a revoked certificate to authenticate successfully over gRPC when etcd is configured with separate HTTP and gRPC client listeners and the Certificate Revocation List (CRL) is not enforced on the gRPC listener.

Such a flaw could potentially lead to unauthorized access to sensitive data stored in etcd, which may impact compliance with data protection standards and regulations like GDPR and HIPAA that require strict access controls and protection of sensitive information.

However, specific impacts on compliance are not detailed in the provided information.

Useful 0 Not Useful 0