CVE-2021-32087

Executive Summary

CVE-2021-32087 is a critical hard-coded credential vulnerability in Quest KACE Systems Deployment Appliance (SMA) version 11.0.273. The appliance ships with a documented default account "kbftp" whose password ("getbxf") is publicly known, allowing any remote attacker with FTP access to authenticate with elevated privileges and retrieve MySQL database backups containing sensitive credentials for other systems. With a CVSS score of 8.8, the vulnerability enables unauthenticated (or low-privileged) remote attackers to achieve full compromise of the appliance and potentially pivot into the broader enterprise network. The vulnerability is publicly documented with PoC information, though no dedicated exploit code or Nuclei template has been published.

Technical Analysis

The root cause of CVE-2021-32087 is the deployment of the KACE SMA with static, hard-coded credentials embedded in the appliance's FTP service configuration. Specifically, an account named "kbftp" is created during the initial install with the password "getbxf". These credentials are publicly documented and never randomized per-installation, meaning every deployment of version 11.0.273 shares the same authentication secret.

From a code-level perspective, the credential is likely stored in a configuration file (e.g., /etc/vsftpd.conf or equivalent FTP daemon configuration) or in the appliance's internal database during the provisioning process. The kbftp account is granted read access to the FTP service root, which includes directories containing MySQL database dumps. These dumps are generated by scheduled backup jobs on the appliance and contain the full contents of the KACE database — including user accounts, device inventory, patch management data, and, critically, privileged credentials for managed endpoints and other integrated systems.

The attack surface is the FTP service exposed on TCP port 21. Because the appliance is a management platform that often resides in a demilitarized zone (DMZ) or an administrative VLAN, the FTP service is typically reachable from the enterprise network and sometimes from the internet. The FTP protocol itself transmits credentials in cleartext, so even if the hard-coded password were not known, an attacker with network visibility could capture it via passive sniffing.

The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials), which is a common weakness in network appliances where manufacturers prioritize ease-of-deployment over security. The severity is amplified by the fact that the kbftp account's access level is sufficient to enumerate and download the backup files, which in many cases contain plaintext or reversibly-encrypted secrets for the entire managed infrastructure.

Exploitation Scenarios

Scenario 1: Remote FTP Access to Backup Exfiltration (Most Likely)

1. Reconnaissance: The attacker scans the target organization's IP space for TCP port 21 using masscan, Nmap, or Shodan. Alternatively, they identify the KACE SMA via HTTP fingerprints (title "KACE Systems Deployment Appliance" on ports 80/443) and then connect to the associated FTP port.
2. Authentication: The attacker connects to the FTP service: ftp <target-ip>. At the login prompt, they enter kbftp as the username and getbxf as the password. Authentication succeeds immediately.
3. Enumeration: Using FTP commands (e.g., ls -la, cd backups, dir), the attacker navigates the directory structure to locate MySQL backup files. Typical paths include /backups/mysql/, /data/dumps/, or similar.
4. Exfiltration: The attacker downloads all backup files using mget * or get <filename>. File sizes may range from a few megabytes to several gigabytes depending on the managed asset count.
5. Credential Extraction: The attacker imports the MySQL dump into a local instance and queries the user and creds tables for privileged credentials (e.g., domain admin accounts, local administrator passwords for managed Windows/macOS/Linux endpoints).
6. Pivot: Using the extracted credentials, the attacker authenticates to critical systems (domain controllers, file servers, database servers) and establishes persistent access via scheduled tasks or RDP sessions.

Scenario 2: FTP Credential Interception via Cleartext

1. The attacker is positioned on the network path (e.g., via ARP spoofing or switch port mirroring compromise).
2. The attacker passively captures FTP traffic (tcpdump -i eth0 port 21).
3. The attacker extracts the credentials being transmitted by a legitimate administrator or automated backup script.
4. The attacker replays the captured credentials or uses them to authenticate directly to the FTP service.

Scenario 3: Chained with Other KACE Vulnerabilities

1. The attacker leverages the FTP access to gain a foothold, then exploits a likely secondary vulnerability (e.g., an authenticated RCE in the SMA web interface) to obtain OS-level root access.
2. With root, the attacker disables logging, exfiltrates the entire database, and installs a persistence mechanism (e.g., a web shell in the KACE web root).

PoC Availability: No public exploit code or Nuclei template exists. However, the attack requires only publicly documented credentials and standard FTP client tools, so exploitation is trivially reproducible with ftp or curl. The low technical barrier means any script kiddie or APT group can weaponize this without custom tooling.

Impact Assessment

The CVSS v3.1 score of 8.8 (High) reflects the following vector components:

• Attack Vector: Network (AV:N) — The FTP service is remotely accessible; no physical or local access required.
• Attack Complexity: Low (AC:L) — The hard-coded password is publicly known; no brute-forcing, custom exploits, or special conditions are required.
• Privileges Required: Low (PR:L) — Attacker needs only valid FTP credentials, which are the documented default; this is effectively "None" in practice since the password is public.
• User Interaction: None (UI:N) — No victim interaction is required.
• Scope: Unchanged (S:U) — The compromise is confined to the appliance's security authority.
• Confidentiality Impact: High (C:H) — MySQL backups contain all managed-device credentials, inventory data, and patch history.
• Integrity Impact: High (I:H) — The attacker could upload malicious files to the FTP service (if write permissions are misconfigured) or use stolen credentials to modify managed systems.
• Availability Impact: High (A:H) — The attacker could delete backups, corrupt the database, or install ransomware via stolen domain admin credentials.

Affected Systems:

• Quest KACE SMA 11.0.273 (confirmed)
• Potentially earlier 11.x and 9.x/10.x versions if they share the same build scripts (unverified)
• All appliances with FTP exposed beyond the trusted management network

Blast Radius: This is a "critical infrastructure amnesia" scenario — the KACE appliance manages the entire endpoint fleet, including patch deployment and configuration enforcement. A compromise of the appliance's FTP backend effectively hands the attacker the keys to every managed computer. In an enterprise with 10,000 managed endpoints, the attacker gains a single point of failure to distribute malware, disable security software, or stage a mass ransomware deployment (e.g., by pushing a malicious patch package to all devices simultaneously).

EPSS Context: The EPSS score of 0.00293 (21.6th percentile) indicates low probability of exploitation in the wild within 30 days. However, this is likely because the vulnerable version is being phased out and the FTP service is often firewalled. This should NOT be interpreted as low risk — the vulnerability is trivially exploitable once an FTP connection is possible.

Detection Guidance

Sigma Rule

title: Quest KACE SMA FTP Login with Default kbftp Credentials
id: 5f7d2c41-8b3e-4a99-9c84-1d2a4e0b8f57
status: experimental
description: Detects FTP login attempts using the documented default kbftp account on Quest KACE SMA appliances.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32087
author: Valtersit Threat Intelligence
date: 2025/01/15
tags:
    - attack.initial_access
    - attack.t1078
    - cve.2021.32087
logsource:
    product: linux
    service: vsftpd
    category: authentication
detection:
    selection:
        user: 'kbftp'
        action: 'successful_login'
    condition: selection
falsepositives:
    - Automated backup scripts that legitimately use the kbftp account (organizations that have not yet patched/changed credentials)
level: high

YARA Rule

rule KACE_SMA_Default_FTP_Creds
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects configuration files or logs referencing the kbftp default password for Quest KACE SMA"
        reference = "CVE-2021-32087"
        date = "2025-01-15"
        score = 80
    strings:
        $p1 = "kbftp" ascii wide
        $p2 = "getbxf" ascii wide
        $p3 = "vsftpd" ascii wide nocase
        $p4 = "KACE" ascii wide nocase
    condition:
        (any of ($p*) and 2 of ($p1,$p2)) or
        ($p1 and $p2 and $p3) or
        ($p1 and $p2 and $p4)
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET 21 (msg:"ET EXPLOIT Quest KACE SMA kbftp default credential login attempt"; flow:to_server,established; content:"USER kbftp"; nocase; content:"PASS getbxf"; nocase; within:100; classtype:attempted-admin; sid:202132087; rev:1; reference:cve,2021-32087;)

Elastic Detection

authentication where event.action == "authentication_success" and
  user.name == "kbftp" and
  process.name == "vsftpd" and
  network.protocol == "ftp"

Splunk SPL Query

index=linux sourcetype=vsftpd* user=kbftp
| stats count min(_time) as first_seen max(_time) as last_seen by host, src_ip
| eval alert_condition = if(count > 1, "repeat_logins", "single_login")
| where alert_condition = "repeat_logins" OR src_ip !in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| table _time, host, src_ip, user, count, first_seen, last_seen

Wazuh OSSEC Rule

<rule id="100384" level="12">
    <if_sid>5310</if_sid>
    <match>kbftp</match>
    <regex>getbxf</regex>
    <description>Quest KACE SMA: Login with default kbftp credentials detected</description>
    <group>authentication_failed,local,pci_dss_10.2.4,gdpr_IV_35.7.d,</group>
    <mitre>
        <id>T1078</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source claims patch, not independently confirmed). NVD lists a patch, but no specific fixed version or vendor advisory has been verified by independent researchers. Treat this with caution and verify with Quest support directly.

1) Immediate Mitigations (within 24-48 hours):

• Change the kbftp password immediately: sudo passwd kbftp (or via the KACE SMA admin console). Use a 20+ character random password.
• If the FTP service is not required for business operations, disable it entirely: sudo systemctl stop vsftpd && sudo systemctl disable vsftpd.
• If FTP must remain active, restrict access at the firewall/ACL level to only trusted management IPs. Do not expose TCP 21 to the internet or untrusted network segments.
• Rotate all credentials stored in the KACE MySQL database, as they may have already been exfiltrated. Prioritize domain admin, local admin, and service account passwords.
• Verify integrity of existing MySQL backups — compare checksums with a known-good offline copy.

2) Patch/Upgrade Steps:

• Contact Quest support (https://www.quest.com/support/) and request the patch for CVE-2021-32087.
• If a patched version is available (e.g., 11.0.274 or later, pending verification), schedule an upgrade during a maintenance window. For SMA 11.0.x, the upgrade process typically involves downloading the .kbin package and applying it via the web admin console (Settings → Appliance Updates).
• After patching, verify the kbftp account password has been randomized and that the FTP service no longer uses the documented default.

3) Long-Term Hardening:

• Migrate from FTP to SFTP (SSH File Transfer Protocol) or FTPS (FTP over TLS) to encrypt credentials in transit. KACE SMA supports SFTP exports in newer versions; enable and use this instead.
• Implement a network segmentation strategy: place the KACE SMA in a dedicated administrative VLAN with strict ingress/egress rules.
• Monitor the appliance's syslog and FTP logs for anomalous access. Set up alerting for any login to kbftp.
• Conduct an inventory of all appliance-to-system integrations and rotate the credentials used for these connections.
• Establish a process to audit default credentials on all network appliances immediately after deployment, using tools like changeme or manual checklist reviews.
• Stage a backup recovery drill to test the organization's ability to restore the KACE database from offline, trusted backups in the event of a full compromise.

References

CISA KEV Status: Not listed in CISA's Known Exploited Vulnerabilities catalog. This means there is no confirmed in-the-wild exploitation, which is consistent with the low EPSS percentile.

Exploit-in-the-Wild Evidence: No public reports of active exploitation have been identified. However, the vulnerability is trivially exploitable with standard tooling, and the lack of public exploit code is likely due to the non-standard nature of FTP-based attacks and the fact that the vulnerable version 11.0.273 is older and being deprecated.

Known Threat Actors:

• APT Groups: No specific APT group has been publicly attributed to exploiting this CVE. However, given the appliance's role in managing endpoint fleets, it is a prime target for supply-chain style attacks. Groups like APT41 (known for targeting network appliances) or Volt Typhoon (focused on U.S. critical infrastructure) could leverage this if they encounter the appliance in a target network.
• Ransomware Operators: Groups such as LockBit or BlackCat have historically targeted enterprise management tools to push ransomware payloads en masse. A compromised KACE SMA would be an ideal distribution mechanism.
• Opportunistic Botnets: The Miraya botnet and other IoT-focused malware have historically used default credentials to compromise appliances. While FTP-only access limits immediate DDoS capability, the MySQL data could be sold on underground markets.

Contextual Analysis: The 2/4 patch confidence score is concerning. NVD claims a patch exists, but the absence of a vendor advisory and verified fixed version suggests either:

• The vendor silently fixed it in a later release without publicizing the change, or
• The "patch" is actually a documentation change instructing users to change default credentials.

In either case, enterprises running KACE SMA 11.0.273 should treat this as unpatched until Quest support explicitly confirms the fix and provides a version number. The lack of a Nuclei template is notable — most high-profile appliance CVEs get detection templates within weeks of disclosure. This, combined with the FTP-specific attack vector, suggests that most security scanners (Tenable, Qualys, Rapid7) may also lack native detection for this issue. SOC teams must rely on manual verification and the detection rules provided above.

References

1. NVD — CVE-2021-32087: https://nvd.nist.gov/vuln/detail/CVE-2021-32087
2. Quest Software — KACE Systems Management Appliance Product Page: https://www.quest.com/products/kace-systems-management-appliance/
3. MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
4. MITRE CWE-798 — Use of Hard-coded Credentials: https://cwe.mitre.org/data/definitions/798.html
5. SANS ISC — Analysis of Hard-coded Credentials in Appliance Products: https://isc.sans.edu/forums/diary/Default+and+Hardcoded+Credentials+in+Enterprise+Appliances/XXXXX (general reference)