CVE-2021-38121

Executive Summary

CVE-2021-38121 is a high-severity vulnerability in NetIQ Advance Authentication, specifically affecting the communication between the authentication client and server. The flaw arises from the use of an insufficient or weak TLS protocol version when a specific service is accessed between devices. This allows an attacker positioned on the network to potentially downgrade the cryptographic security of the connection, leading to the interception or manipulation of authentication traffic. With a CVSS score of 8.3, this vulnerability poses a significant risk to the confidentiality and integrity of authentication data. No public proof-of-concept (PoC) or exploit code has been identified at this time, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild. The vendor, NetIQ, has released a fix in version 6.3.5.1.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise authentication solution from NetIQ (now part of Micro Focus). Therefore, supply chain package security considerations are not directly applicable. However, organizations should ensure that the NetIQ Advance Authentication software is obtained from official, trusted sources and that integrity checks are performed during deployment.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same network segment as the affected devices.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit the weak TLS protocol.
• Privileges Required (PR): None (N) – No authentication is needed to initiate the attack.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Weak TLS can lead to exposure of sensitive authentication data.
• Integrity (I): High (H) – An attacker could modify authentication traffic.
• Availability (A): High (H) – While not directly targeted, a successful attack could disrupt authentication services.

Threat Level: High. The vulnerability allows for man-in-the-middle (MITM) attacks on authentication traffic, potentially leading to credential theft or session hijacking. The low EPSS score suggests limited active exploitation, but the high CVSS score warrants immediate attention.

Deep Dive & Mechanics

The vulnerability resides in the TLS protocol negotiation between the NetIQ Advance Authentication client and server. When a specific service is accessed, the software fails to enforce a minimum TLS version, allowing the use of outdated and weak protocols such as TLS 1.0 or TLS 1.1. These older protocols are susceptible to known attacks like POODLE, BEAST, and others that can compromise the security of the encrypted channel.

Root Cause: The software does not properly validate or restrict the TLS version during the handshake for a particular service endpoint. This allows an attacker to perform a protocol downgrade attack, forcing the client and server to use a weaker TLS version that the attacker can then break.

Attack Scenario:

1. An attacker gains a position on the network between the NetIQ Advance Authentication client and server (e.g., via ARP spoofing, rogue access point, or compromised network device).
2. The attacker intercepts the TLS handshake and manipulates the ClientHello or ServerHello messages to negotiate a weak TLS version (e.g., TLS 1.0).
3. The client and server, due to the vulnerability, accept the downgraded protocol.
4. The attacker can then exploit weaknesses in the older TLS protocol to decrypt or modify the authentication traffic, potentially capturing credentials or injecting malicious data.

Vulnerable vs. Patched Code

Since this is a proprietary software vulnerability, specific code snippets are not publicly available. However, the fix involves enforcing a minimum TLS version (e.g., TLS 1.2) in the server configuration and client library.

Vulnerable Configuration (Conceptual):

# In server configuration file (e.g., server.conf)
TLS_Version = TLSv1.0, TLSv1.1, TLSv1.2

Patched Configuration (Conceptual):

# In server configuration file (e.g., server.conf)
TLS_Version = TLSv1.2

The patched version (6.3.5.1) likely includes code changes to:

• Reject TLS versions below 1.2.
• Validate the TLS version during the handshake for all service endpoints.
• Log and alert on any attempts to use weak TLS versions.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Demonstrate the ability to downgrade the TLS connection and capture authentication traffic.

Prerequisites:

• Two machines: one running NetIQ Advance Authentication server (vulnerable version < 6.3.5.1) and one running the client.
• Attacker machine on the same network segment with tools like mitmproxy, sslstrip, or custom Python scripts using scapy and ssl.

Lab Setup:

1. Set up the NetIQ Advance Authentication server and client in a controlled lab environment.
2. Ensure the attacker machine can intercept traffic (e.g., using ARP spoofing with arpspoof).

Exploitation Steps:

1. ARP Spoofing: On the attacker machine, run:

   echo 1 > /proc/sys/net/ipv4/ip_forward
   arpspoof -i eth0 -t <client_ip> <server_ip>
   arpspoof -i eth0 -t <server_ip> <client_ip>
   

2. Intercept TLS Handshake: Use a tool like mitmproxy with a custom script to force TLS 1.0:

   # mitmproxy script to downgrade TLS
   from mitmproxy import tls
   def tls_clienthello(data):
       # Force TLS 1.0
       data.client_version = 0x0301
       return data
   

3. Capture Traffic: Use Wireshark or tcpdump to capture the downgraded traffic.
4. Decrypt Traffic: If the weak TLS version is exploitable (e.g., using a known attack), attempt to decrypt the captured data.

Note: Since no public exploit exists, this is a theoretical demonstration. Actual exploitation may require custom tooling.

Blue Team (Defensive)

Objective: Detect and prevent TLS downgrade attacks.

Detection:

• Monitor network traffic for TLS handshakes using versions below TLS 1.2.
• Use intrusion detection systems (IDS) to alert on weak TLS cipher suites.

Prevention:

• Immediately upgrade to NetIQ Advance Authentication version 6.3.5.1 or later.
• If upgrade is not possible, implement network segmentation to limit access to the authentication server.
• Use a TLS inspection proxy to enforce minimum TLS version at the network perimeter.

Indicators of Compromise (IOCs)

• Network IOCs:

  • TLS handshake packets with version fields set to 0x0301 (TLS 1.0) or 0x0302 (TLS 1.1) between NetIQ Advance Authentication client and server.
  • Unusual ARP traffic indicating ARP spoofing (e.g., multiple MAC addresses for the same IP).
  • Presence of mitmproxy or similar tools on the network.

• Host IOCs:

  • Log entries on the NetIQ Advance Authentication server indicating TLS version negotiation failures or downgrades.
  • Unauthorized processes running on the server or client that could intercept network traffic.

• File IOCs:

  • Modified configuration files (e.g., server.conf) that allow weak TLS versions.

Detection Engineering

YARA Rule

rule Detect_Weak_TLS_NetIQ_AdvAuth {
    meta:
        description = "Detects weak TLS version usage in NetIQ Advance Authentication traffic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-38121"
    strings:
        $tls10 = { 03 01 }  // TLS 1.0 version in handshake
        $tls11 = { 03 02 }  // TLS 1.1 version in handshake
        $netiq = "NetIQ" nocase
    condition:
        ($tls10 or $tls11) and $netiq
}

Sigma Rule

title: Weak TLS Version in NetIQ Advance Authentication
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects TLS handshakes using TLS 1.0 or 1.1 for NetIQ Advance Authentication
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-38121
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        service: "ssl"
        version:
            - "TLSv10"
            - "TLSv11"
        server_name: "netiq"  # Adjust based on actual server name
    condition: selection
falsepositives:
    - Legitimate use of weak TLS for legacy systems (should be rare)
level: high

Suricata Rule

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2021-38121 - Weak TLS Version in NetIQ Advance Authentication"; flow:to_server; tls.version:0x0301 or tls.version:0x0302; content:"NetIQ"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update NetIQ Advance Authentication to version 6.3.5.1 or later. This is the only complete fix.
2. Network Segmentation: Isolate the authentication server on a dedicated VLAN with strict access controls.
3. TLS Enforcement: If upgrade is delayed, configure the server to only accept TLS 1.2 or higher (if the version allows configuration).

Long-Term Measures:

• Implement a TLS inspection and enforcement solution at the network perimeter.
• Regularly audit TLS configurations across all enterprise applications.
• Monitor for any attempts to use weak TLS protocols using the detection rules provided.

Workarounds (if upgrade is not possible):

• Disable the specific service that triggers the weak TLS negotiation, if feasible.
• Use a VPN or IPsec tunnel to add an additional layer of encryption between client and server.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert