CVE-2021-35001

Executive Summary

CVE-2021-35001 is a Missing Authorization vulnerability in BMC Track-It!, a popular IT service management (ITSM) platform. The flaw resides in the GetData endpoint, which fails to enforce proper authorization checks before allowing access to sensitive functionality. An authenticated attacker can exploit this to disclose stored credentials, potentially leading to lateral movement and further compromise of the IT infrastructure. The vulnerability has a low CVSS score of 3.1 due to the requirement for authentication, but the potential impact is high as it exposes credentials that could be used to pivot to other systems. No public proof-of-concept (PoC) or exploit code is available, and no patch has been released by BMC.

Supply Chain & Package Security

This vulnerability is not related to open-source package ecosystems (NPM, PyPI, Go, Ruby). It affects a proprietary commercial software product (BMC Track-It!). Therefore, supply chain security considerations are limited to the software's internal dependencies and the risk of credential exposure within the organization's deployment.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 3.1 (Low)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Attacker needs valid credentials.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - Impact is confined to the vulnerable component.
• Confidentiality (C): High (H) - Complete disclosure of stored credentials.
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No denial of service.

Threat Level: Low (due to authentication requirement), but the business impact is High because exposed credentials can lead to a full compromise of the IT management platform and connected systems.

Deep Dive & Mechanics

The vulnerability exists in the GetData endpoint of BMC Track-It!. This endpoint is designed to retrieve data from the application's database. The flaw is a classic case of Missing Authorization (CWE-862). The application fails to verify that the authenticated user has the necessary permissions to access the specific data requested via this endpoint.

Mechanics:

1. An attacker authenticates to the BMC Track-It! web interface with valid low-privilege credentials (e.g., a helpdesk user account).
2. The attacker crafts a request to the GetData endpoint, likely by manipulating parameters that specify which data to retrieve (e.g., table names, record IDs, or SQL-like queries).
3. The server processes the request without checking if the authenticated user is authorized to access the requested data.
4. The server returns the sensitive data, which includes stored credentials (e.g., passwords for integrated systems, service accounts, or other users).
5. The attacker can then use these credentials to access other systems or escalate privileges within Track-It!.

The vulnerability was reported via the Zero Day Initiative (ZDI-CAN-14527). The lack of a patch from BMC suggests the vendor may have deemed the risk low or has not prioritized a fix.

Vulnerable vs. Patched Code

Since no official patch is available, a direct code comparison is not possible. However, the vulnerable code pattern can be described:

Vulnerable Code (Conceptual):

// Vulnerable: No authorization check
[HttpPost]
public IActionResult GetData([FromBody] DataRequest request)
{
    // Directly executes query without checking user permissions
    var data = _dbContext.ExecuteQuery(request.Query);
    return Ok(data);
}

Patched Code (Conceptual):

// Patched: Authorization check added
[HttpPost]
[Authorize(Policy = "CanAccessSensitiveData")]
public IActionResult GetData([FromBody] DataRequest request)
{
    // Verify user has permission to access the requested data
    if (!_authorizationService.Authorize(User, request.DataType, "Read"))
    {
        return Forbid();
    }
    var data = _dbContext.ExecuteQuery(request.Query);
    return Ok(data);
}

The patched version would implement a role-based or attribute-based access control check before processing the request.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid low-privilege credentials for BMC Track-It!.
• Network access to the Track-It! web interface.

Exploitation Steps:

1. Authenticate: Log in to the Track-It! web application with the low-privilege account.
2. Identify Endpoint: Use browser developer tools or a proxy (e.g., Burp Suite) to capture the request to the GetData endpoint. This is typically a POST request to a URL like /api/GetData or /TrackIt/GetData.
3. Craft Payload: Modify the request parameters to request sensitive data. For example, change the table or query parameter to target the Users table or a configuration table containing credentials.

   POST /api/GetData HTTP/1.1
   Host: trackit.example.com
   Cookie: ASP.NET_SessionId=...
   Content-Type: application/json
   
   {
     "query": "SELECT * FROM Users WHERE IsAdmin = 1",
     "table": "Users"
   }
   

4. Extract Data: The server will return the results, including hashed or plaintext credentials.
5. Pivot: Use the extracted credentials to access other systems or escalate privileges.

No public exploit code is available. The above is a conceptual exploitation flow.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual access to the GetData endpoint from low-privilege accounts.
• Look for requests with unusual or large query parameters.
• Alert on any successful retrieval of data from sensitive tables (e.g., Users, Credentials, Config).

Defense:

• Immediate: If possible, restrict access to the GetData endpoint via a Web Application Firewall (WAF) or reverse proxy to only allow requests from trusted IPs or with specific headers.
• Mitigation: Implement network segmentation to limit the blast radius if credentials are exposed.
• Monitoring: Enable detailed logging for all API requests and correlate with user roles.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/GetData or /TrackIt/GetData with unusual query parameters.
  • Requests containing SQL-like syntax in the POST body (e.g., SELECT * FROM).
• Logs:
  • Application logs showing access to the GetData endpoint by users who should not have such access.
  • Database logs showing unexpected queries executed by the Track-It! application user.
• System:
  • Unusual outbound connections from the Track-It! server to other internal systems, potentially using credentials extracted via this vulnerability.

Detection Engineering

YARA Rule

rule CVE_2021_35001_BMC_TrackIt_GetData {
    meta:
        description = "Detects requests targeting the vulnerable GetData endpoint in BMC Track-It!"
        author = "Valters IT"
        date = "2024-05-24"
        reference = "CVE-2021-35001"
        hash = "unknown"
    strings:
        $endpoint = "/api/GetData" nocase
        $endpoint2 = "/TrackIt/GetData" nocase
        $sql_keyword = "SELECT" nocase
        $sql_keyword2 = "FROM" nocase
        $sql_keyword3 = "WHERE" nocase
    condition:
        any of ($endpoint*) and 2 of ($sql_keyword*)
}

Sigma Rule

title: CVE-2021-35001 - BMC Track-It! GetData Missing Authorization
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2021-35001 by monitoring for suspicious requests to the GetData endpoint.
author: Valters IT
date: 2024/05/24
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-35001
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-stem:
            - '/api/GetData'
            - '/TrackIt/GetData'
        cs-method: 'POST'
    condition: selection
falsepositives:
    - Legitimate administrative use of the endpoint.
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-35001 - BMC Track-It! GetData Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/GetData"; http_uri;
    content:"SELECT"; http_client_body;
    content:"FROM"; http_client_body;
    sid:10000001;
    rev:1;
    reference:cve,2021-35001;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

No official patch is available. The following mitigations are recommended:

1. Network Segmentation: Place the BMC Track-It! server in a restricted network segment with strict firewall rules. Limit access to only necessary users and systems.
2. Access Control: Review and enforce the principle of least privilege for all Track-It! user accounts. Disable or remove any unnecessary accounts.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests to the GetData endpoint that contain SQL-like keywords (e.g., SELECT, FROM, WHERE) unless they come from trusted administrative IPs.
4. Monitoring & Alerting: Implement the detection rules provided above to alert on any suspicious activity.
5. Vendor Contact: Contact BMC support to inquire about a potential hotfix or workaround. Consider migrating to a different ITSM solution if the risk is unacceptable.
6. Credential Rotation: Immediately rotate any credentials stored within the Track-It! system, especially service accounts and administrative passwords.

Valters IT