CVE-2021-22518

Executive Summary

CVE-2021-22518 is a vulnerability in OpenText™ Identity Manager AzureAD Driver that allows sensitive information to be written into log files. This flaw affects all versions prior to 5.1.4.0. The vulnerability has a CVSS score of 5.8 (Medium) and is classified under CWE-532 (Insertion of Sensitive Information into Log File). The EPSS score is 0.0%, indicating a low probability of exploitation in the wild. No public proof-of-concept (PoC) code or exploit templates are currently available. The primary risk is the exposure of credentials or other sensitive data through log files, which could be leveraged by an attacker with local access to the system.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.8 (Medium)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – The attacker needs low-level privileges.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Sensitive information is exposed.
• Integrity (I): None (N) – No data integrity impact.
• Availability (A): None (N) – No availability impact.

Threat Level: Medium. The vulnerability requires local access, but the potential exposure of sensitive data (e.g., credentials) makes it a significant risk in multi-tenant or shared environments.

Deep Dive & Mechanics

The vulnerability exists in the logging mechanism of the OpenText™ Identity Manager AzureAD Driver. The driver, which synchronizes identity data between OpenText Identity Manager and Azure Active Directory, logs sensitive information such as authentication tokens, passwords, or API keys into plaintext log files. This occurs due to improper sanitization of log output.

Root Cause: The driver’s logging functions do not filter or mask sensitive data before writing to log files. This is a classic CWE-532 issue.

Attack Scenario: An attacker with local access to the server (e.g., through a compromised low-privilege account or physical access) can read the log files to extract credentials. These credentials could then be used to escalate privileges or access Azure AD resources.

Affected Components:

• OpenText Identity Manager AzureAD Driver versions < 5.1.4.0

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Logs sensitive data directly
def log_authentication(token):
    log.write(f"Authentication token: {token}")

Patched Code (Conceptual):

# Patched: Masks sensitive data
def log_authentication(token):
    masked_token = token[:4] + "****" + token[-4:]
    log.write(f"Authentication token: {masked_token}")

The patch ensures that sensitive fields are masked or omitted from log output. The exact fix is available in version 5.1.4.0.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to the target system (e.g., via SSH or RDP).
• Low-privilege user account.

Steps:

1. Identify the log file location (typically /var/log/opentext/azuread-driver.log or similar).
2. Read the log file:

   cat /var/log/opentext/azuread-driver.log | grep -E "(password|token|secret|key)"
   

3. Extract sensitive data (e.g., Azure AD service principal credentials).
4. Use extracted credentials to authenticate to Azure AD:

   az login --service-principal -u <client-id> -p <client-secret> --tenant <tenant-id>
   

No public exploit code is available.

Blue Team (Defense)

Detection:

• Monitor for unauthorized access to log files (e.g., auditd rules).
• Use file integrity monitoring (FIM) to detect changes to log files.

Prevention:

• Apply the vendor patch (upgrade to version 5.1.4.0 or later).
• Restrict log file permissions to only privileged users.
• Implement log rotation and retention policies.

Hunting:

• Search for log entries containing patterns like password=, token=, or secret=.
• Correlate with Azure AD sign-in logs for unusual activity.

Indicators of Compromise (IOCs)

• File Paths:
  • /var/log/opentext/azuread-driver.log
  • /var/log/opentext/azuread-driver*.log
• Log Patterns:
  • password=
  • token=
  • secret=
  • client_secret=
• Network Indicators:
  • Unusual Azure AD authentication from unexpected IPs.
• Process Indicators:
  • cat, grep, or less processes accessing log files by non-privileged users.

Detection Engineering

YARA Rule

rule CVE_2021_22518_Sensitive_Logging {
    meta:
        description = "Detects sensitive data in OpenText Identity Manager AzureAD Driver logs"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2021-22518"
    strings:
        $s1 = /password\s*[:=]\s*\S+/ nocase
        $s2 = /token\s*[:=]\s*\S+/ nocase
        $s3 = /secret\s*[:=]\s*\S+/ nocase
        $s4 = /client_secret\s*[:=]\s*\S+/ nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: CVE-2021-22518 - Sensitive Data in OpenText AzureAD Driver Logs
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects log entries containing sensitive data from OpenText Identity Manager AzureAD Driver
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|contains: 'opentext/azuread-driver'
        TargetFilename|endswith: '.log'
    keywords:
        - 'password='
        - 'token='
        - 'secret='
        - 'client_secret='
    condition: selection and keywords
falsepositives:
    - Legitimate log entries with masked data (after patch)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2021-22518 - Sensitive Data Exfiltration via OpenText AzureAD Driver"; flow:to_server,established; content:"password"; nocase; content:"token"; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to OpenText Identity Manager AzureAD Driver version 5.1.4.0 or later.
2. Rotate any credentials that may have been exposed in log files.
3. Review log files for any leaked sensitive data and take corrective action.

Long-term Measures:

• Implement log masking for all sensitive fields.
• Use centralized logging with access controls and encryption.
• Conduct regular security audits of log management practices.

Workaround (if patching is not possible):

• Restrict log file permissions to root only.
• Disable verbose logging if not required.
• Monitor log files for unauthorized access.

Valters IT