-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is an improper authorization check in the SSH certificate revocation process, specifically within the SSHPOP provisioner. The analysis of the security patch (commit 1011f5f5408b470a636f583bf74c0d7bbaf75d72) reveals the root cause and the affected functions.
The primary vulnerable function is github.com/smallstep/certificates/authority/provisioner.(*SSHPOP).AuthorizeSSHRevoke. Before the patch, this function did not correctly validate that the serial number of the SSH certificate being revoked matched the identity (subject) within the authorization token. This allowed a user with rights to get a token to revoke any SSH certificate, not just their own.
The exploitation path starts at the github.com/smallstep/certificates/api.SSHRevoke API endpoint, which receives the revocation request. This endpoint calls into the github.com/smallstep/certificates/authority.(*Authority).Authorize method, which in turn dispatches to the vulnerable (*SSHPOP).AuthorizeSSHRevoke function. After authorization, (*Authority).Revoke is called to complete the revocation.
The patch addresses the vulnerability at two levels:
(*SSHPOP).AuthorizeSSHRevoke to strictly compare the token subject with the certificate serial number.(*Authority).Revoke to also compare the serial number from the request with the token subject, preventing similar issues in other provisioners and providing an extra layer of security.Therefore, during an exploit, api.SSHRevoke, authority.Authorize, provisioner.(*SSHPOP).AuthorizeSSHRevoke, and authority.Revoke would all appear in a runtime profile.
github.com/smallstep/certificates/authority/provisioner.(*SSHPOP).AuthorizeSSHRevokeauthority/provisioner/sshpop.go
github.com/smallstep/certificates/api.SSHRevokeapi/sshRevoke.go
github.com/smallstep/certificates/authority.(*Authority).Revokeauthority/tls.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/smallstep/certificates | go | <= 0.28.4 | 0.29.0 |
GoGoOngoing coverage of React2Shell