CVE-2021-32084

Executive Summary

CVE-2021-32084 is a critical access control bypass vulnerability in the Quest KACE Systems Deployment Appliance (SDA) version 11.0.273. The flaw allows unauthenticated remote attackers to bypass IP-based access restrictions enforced on the web console by directly interacting with the underlying REST API endpoints. Successful exploitation results in full compromise of the appliance and, by extension, every managed endpoint configured within the KACE environment. With a CVSS score of 9.8 and public proof-of-concept material available, this vulnerability poses an immediate and severe risk to any enterprise still operating an unpatched KACE SDA.

Technical Analysis

The vulnerability resides in the API layer of the Quest KACE SMA (Systems Management Appliance). Administrators commonly restrict access to the web management console by configuring IP allowlists or subnet restrictions. This is a standard security control intended to limit administrative access to trusted network segments. However, the KACE software fails to propagate these same access control checks to the API endpoints served by the appliance.

The KACE API is a RESTful interface used for automation, asset inventory, software deployment, and configuration management. These endpoints are exposed on the same network interface as the web console. The authentication mechanism for the API requires credentials (username/password or API keys) but does not enforce the IP-based restriction logic defined for the web UI. This architectural oversight means that an attacker who obtains valid API credentials—through phishing, credential stuffing, leaked configuration files, or previously compromised accounts—can interact with the appliance's full API surface regardless of the source IP address.

From a code-level perspective, the issue is a classic failure in authorization enforcement. The web console likely implements a middleware filter or HTTP module that checks the client's IP address against the allowed ranges. These checks are absent or incorrectly scoped for the API routes. The API handler functions validate the supplied authentication token but never query the network access policy database, leading to a gap between the intended security policy and the actual enforcement.

The attack surface is significant. API endpoints allow for creating, reading, updating, and deleting managed devices, pushing software packages, modifying deployment tasks, and fetching sensitive system information such as credentials stored for managed endpoints. An attacker who can reach the API can also potentially upload malicious scripts or packages to be deployed to every managed machine, effectively turning the KACE appliance into a distribution point for malware or ransomware.

Exploitation Scenarios

The following step-by-step attack chain outlines how an adversary could exploit CVE-2021-32084.

1. Reconnaissance: The attacker scans the internet or internal network for exposed KACE appliances. The default web console port is typically 8443. Shodan queries such as http.title:"KACE" or product:"Quest KACE Systems Management Appliance" can identify targets.

2. Credential Acquisition: The attacker obtains valid API credentials. Potential vectors include:

   • Phishing attacks targeting administrators.
   • Credential stuffing using previously breached password dumps (e.g., from unrelated services).
   • Inspecting publicly exposed configuration files or documentation that may contain default or leaked API keys.
   • Exploiting a secondary vulnerability to retrieve stored credentials.

3. Bypass Access Controls: The attacker directly sends HTTP requests to the API endpoints, bypassing the web console's IP-based restrictions. For example, a request to https://<KACE_IP>:8443/api/inventory/device with valid headers and authentication tokens will succeed even if the attacker's source IP is not in the allowed list.

4. Enumeration & Privilege Escalation: The attacker uses the API to enumerate managed devices, collect system details, and identify high-value targets. They may also query or modify administrative user accounts to establish persistent access.

5. Full Compromise: The attacker uploads a malicious payload (e.g., a PowerShell script, MSI package, or executable) via the API and schedules it for deployment across all managed endpoints. This effectively grants remote code execution on every machine in the environment managed by the KACE appliance.

Public proof-of-concept materials exist, demonstrating how to craft the API requests. No Nuclei template or standalone exploit code is publicly available, but the API documentation and the NVD description provide sufficient detail for a skilled attacker to reproduce the attack without difficulty.

Impact Assessment

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) highlights the severity: an unauthenticated (PR:N) remote (AV:N) attacker with low complexity (AC:L) can achieve high confidentiality, integrity, and availability impact. However, it is critical to note that the "unauthenticated" label in the CVSS scoring is contingent on the attacker being considered an outsider; in practice, the API requires credentials, but the score reflects the fact that any remote user can attempt authentication. The lack of user interaction (UI:N) makes the vulnerability highly automatable.

The blast radius extends beyond the appliance itself. The KACE SDA is designed to provision and manage an entire fleet of endpoints, often including servers and critical workstations. A compromised KACE appliance means:

• Lateral Movement: The attacker can use the appliance as a pivot point to reach the internal network segment hosting managed devices.
• Data Exfiltration: The appliance stores inventory data, software assets, and potentially credentials for domain accounts, which can be harvested.
• Ransomware Deployment: The ability to push software packages is a direct pipeline for distributing ransomware across hundreds or thousands of machines simultaneously.
• Availability Disruption: An attacker could delete inventory records, disable deployment tasks, or corrupt the appliance's operating system, causing widespread management outages.

The fact that IP-based access controls—often considered a reliable first line of defense—can be trivially bypassed increases the likelihood that this vulnerability will be exploited in environments that have otherwise followed security best practices.

Detection Guidance

Detecting exploitation of CVE-2021-32084 requires monitoring for anomalous API activity that originates from IP addresses not permitted by the configured web console policy.

Sigma Rule

title: Quest KACE API Access from Non-Allowlisted IP
id: c6f1a0b2-3c4d-4e5f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects API requests to Quest KACE SMA from source IPs that are not on the allowlist for the web console.
logsource:
  product: web
  service: accesslog
detection:
  selection_uri:
    cs-uri-extension|startswith:
      - '/api/'
  selection_method:
    cs-method: 'GET'
  filter_known_ips:
    c-ip|contains:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: selection_uri and selection_method and not filter_known_ips
level: critical
falsepositives:
  - API calls from new, unregistered management segments (rare).
  - Misconfigured reverse proxies.
tags:
  - attack.t1190
  - cve.2021-32084

YARA Rule

rule Quest_KACE_API_Bypass_2021
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects suspicious API calls associated with CVE-2021-32084"
        date = "2024-05-01"
        cve = "CVE-2021-32084"
        severity = "high"
    strings:
        $api_path = "/api/" ascii wide
        $credential_access = "credential" ascii wide
        $device_read = "inventory/device" ascii wide
        $deploy_task = "deployment/task" ascii wide
    condition:
        $api_path and (any of ($credential_access, $device_read, $deploy_task))
}

Suricata IDS Rule

alert http any any -> $KACE_SERVERS 8443 (msg:"CVE-2021-32084 - Quest KACE API Access Bypass"; flow:to_server,established; http.uri; content:"/api/"; http.uri; content:"credential"; http.uri; content:"deployment"; pcre:"/\/api\/.*\/(credential|deployment|device\/)/i"; sid:20213208; rev:1; reference:cve,2021-32084; classtype:attempted-admin;)

Elastic Detection

sequence by source.ip
  with maxspan=10m
  [network where event.type == "start" and destination.port == 8443 and destination.ip == "KACE_APPLIANCE_IP" and network.protocol == "http"]
  [http where http.request.method == "GET" and http.request.uri like "*api*" and http.request.uri like "*credential*"]

Splunk SPL Query

index=web sourcetype=iis:log OR sourcetype=apache:access
| where like(uri, "%/api/%")
| eval is_allowlisted=if(match(clientip, "^(10\.|192\.168\.)"), "allowed", "suspicious")
| search is_allowlisted="suspicious"
| stats count by clientip, uri, status
| sort - count

Wazuh OSSEC Rule

<group name="quest_kace,">
  <rule id="100841" level="15">
    <decoded>api_access</decoded>
    <match>GET /api/</match>
    <description>Quest KACE API accessed from non-allowlisted IP - possible CVE-2021-32084 exploitation</description>
    <group>pci_dss_6.5, gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for this CVE is rated 2/4 (CLAIMED), meaning a single source (NVD) reports a patch exists, but the specific fixed version has not been independently confirmed by our team.

1. Immediate Mitigations:

   • Apply the vendor-provided patch or upgrade to the latest version of KACE SMA immediately, if available.
   • As a temporary measure, restrict API access at the network layer using firewalls or network access control lists (ACLs) to only allow traffic from trusted management subnets. Do not rely solely on the appliance's internal IP filtering.
   • Rotate all API keys and credentials associated with the KACE appliance, as they may have been exposed.

2. Patch/Upgrade Steps:

   • Consult the official Quest KACE documentation for the latest software version that addresses CVE-2021-32084.
   • Download and apply the vendor update using the standard upgrade procedure, ensuring a full backup of the appliance configuration and database is taken first.
   • Verify the patch has been applied by checking the appliance version number and, if possible, auditing the access control configuration for API routes.

3. Long-Term Hardening:

   • Isolate the KACE appliance on a dedicated management VLAN with strict egress controls.
   • Implement multi-factor authentication (MFA) for all administrative accounts that can access the appliance.
   • Regularly audit API access logs for anomalous behavior and track successful authentication events.
   • Disable any API endpoints that are not required for your operational workflows.
   • Subscribe to vendor security advisories to receive prompt notifications of future vulnerabilities.

References

As of the date of this report, CVE-2021-32084 is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no public evidence of mass exploitation in the wild. However, the vulnerability has characteristics that make it attractive to threat actors: it is easily reachable, has a critical severity rating, and targets a device that manages a large number of endpoints. Mid-tier and enterprise environments using KACE are common across various sectors, including education, government, and healthcare.

While no specific APT group or ransomware gang has been publicly attributed to exploiting this exact CVE, the attack surface is a prime candidate for initial access. Threat actors frequently scan for exposed management appliances and abuse their administrative functions to push malware. The existence of public proof-of-concept material lowers the barrier to entry for opportunistic criminals.

The EPSS score of 0.00327 (25.3rd percentile) indicates a low probability of exploitation in the near term. Nevertheless, the potential for high impact if exploited justifies prioritizing remediation. We recommend monitoring for any future updates to the CISA KEV list and vendor advisories for signs of increased activity.

References

1. NVD - CVE-2021-32084: https://nvd.nist.gov/vuln/detail/CVE-2021-32084
2. Quest KACE Systems Management Appliance Security Advisory: (Refer to vendor's official support portal for the specific patch release notes)
3. CWE-284: Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
4. MITRE ATT&CK - T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog