Revoked Client Certificate Authentication Bypass in Stormshield Network Security

Compliance Impact

This vulnerability allows an attacker possessing a revoked client certificate to gain administrative access to the Stormshield Network Security captive-admin portal, potentially exposing confidential information.

Such unauthorized administrative access could lead to breaches of confidentiality, which may impact compliance with standards and regulations like GDPR and HIPAA that require protection of sensitive data and strict access controls.

However, the provided information does not explicitly discuss the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability allows a revoked client certificate to still be used to authenticate to the Stormshield Network Security administration portal. Essentially, an attacker who possesses a revoked certificate can gain administrative access to the portal despite the certificate being revoked.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker with a revoked certificate to gain unauthorized administrative access to the Stormshield Network Security portal. This compromises the confidentiality of the system, as sensitive administrative functions could be accessed without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by verifying if revoked client certificates are still able to authenticate to the Stormshield Network Security administration portal.

A practical approach is to test authentication attempts using revoked certificates to see if access is granted, indicating the vulnerability is present.

There is no specific detection command mentioned, but administrators can use the 'nrestart sld' command after revoking certificates to ensure the system properly invalidates them.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, administrators should run the command 'nrestart sld' after revoking any client certificates.

Alternatively, disabling certificate-based authentication can also prevent exploitation of this issue.

For a permanent fix, updating Stormshield Network Security to versions 5.0.6, 4.8.16, or 4.3.42 where the vulnerability is resolved is recommended.

Useful 0 Not Useful 0