CVE-2021-43821

Executive Summary

CVE-2021-43821 is a high-severity arbitrary file disclosure vulnerability in Opencast, an open-source lecture capture and video management platform used primarily in educational institutions. The flaw allows an authenticated attacker with media-ingestion privileges to embed references to local file URLs in ingested media packages, causing the server to read local files from the host machine and expose their contents through the web interface. With a CVSS score of 9.9, this vulnerability represents a critical risk to any Opencast deployment where ingestion privileges are broadly granted — a common configuration in academic environments. The issue is confirmed patched in Opencast 10.6 and 11.0; all earlier versions, including 9.x and 10.x prior to 10.6, remain affected.

Technical Analysis

The vulnerability resides in Opencast's media ingestion pipeline, the process by which new video or audio content is added to the platform for processing and publication. When an operator submits a media package for ingestion, Opencast parses the package's manifest and determines the source locations for all media files. Prior to version 9.10 or 10.6, the ingestion subsystem failed to validate the scheme (protocol) of URLs referenced in the media package. Specifically, it did not restrict the use of file:// URL scheme URIs.

This flaw falls under CWE-706 — Use of Incorrectly-Resolved Name or Reference. Opencast's URL resolution logic would accept file:// URIs as legitimate media sources and, during the ingestion workflow, open the referenced local path and read its contents. The read content is then treated as if it were an uploaded media file and made accessible via the platform's web-based playback and download interface.

The attack surface is the Opencast administrative or operator-facing ingestion API — the mechanism through which authorized users submit new media. The critical detail is the privilege model: the NVD description explicitly notes that the privileges required to add new media "are often widely given." This is a systemic characteristic of lecture-capture deployments, where many instructors, teaching assistants, and departmental staff are granted ingestion rights as part of their normal workflow.

The file-read primitive is bounded only by the operating system privileges of the Opencast service account. On a default deployment, this account typically has read access to system configuration files, application secrets, database credentials, TLS private keys, and potentially user data depending on the host's filesystem layout. The description notes that UNIX permissions or SELinux can narrow the scope of what is readable but cannot protect files the Opencast process legitimately needs to read.

Insufficient technical detail is available in the NVD description regarding the exact code paths, function names, or API endpoints involved in the vulnerable URL resolution. The description establishes the following facts: (1) local file URLs are allowed in ingested media packages, (2) Opencast opens and includes local files during ingests, (3) the attacker must have media-add privileges, and (4) the fix is in 10.6 and 11.0.

Exploitation Scenarios

The exploitation chain is as follows:

Step 1 — Reconnaissance and Target Identification. An attacker first identifies an Opencast instance. Public-facing lecture-capture portals are readily discoverable via search engines using terms such as "Opencast" or "lecture capture login." The attacker then determines whether they have (or can obtain) an account with media-ingestion privileges. In many academic deployments, this is as simple as possessing a faculty or staff account, since ingestion rights are broadly granted.

Step 2 — Triggering the Vulnerability. The attacker authenticates to the Opencast web interface and initiates the media-upload/ingestion workflow. Instead of uploading a legitimate video file, the attacker crafts a media package that references a local file URL pointing to a sensitive file on the host machine. Platform-specific details of the required URL format or manifest structure are not disclosed in the NVD description; the attack is performed at the file-reference level within the media package ingestion mechanism.

Step 3 — Payload Execution. The attacker submits the crafted media package. The Opencast ingestion service parses the package, resolves the file:// URL, and reads the referenced local file from the host filesystem. The file is treated as a media asset, processed, and stored.

Step 4 — Post-Exploitation Data Exfiltration. The attacker accesses the ingested "media" through the normal web-based playback or download interface. The sensitive file's contents are returned. Depending on the file's size and binary nature, the attacker may need to adapt the file to the expected media format or use the raw download endpoint; however, the NVD description confirms that the content is "made available via the web interface."

The impact scope is governed by the permissions of the Opencast process account. On typical deployments, this includes:

• Application secrets: database credentials, API keys, encryption keys stored in configuration files.
• OS-level secrets: /etc/shadow (if readable), SSH private keys, Kerberos keytabs.
• TLS private keys: certificates used for HTTPS termination.
• Other user data: any files the service account can read.

PoC/Exploit Status: No public proof-of-concept or exploit code has been identified. The attack chain above is inferred from the vulnerability class (arbitrary file read via URL scheme confusion) and the NVD description.

Impact Assessment

The vulnerability's CVSS score of 9.9 reflects the near-maximum severity of a file-read primitive. The vector details support the following assessment:

• Attack Vector: Network — The flaw is exploitable remotely through the web interface.
• Attack Complexity: Low — No special conditions beyond the required privileges.
• Privileges Required: Low — A low-privileged operator account with media-add rights suffices.
• User Interaction: None — No victim interaction is required.
• Scope: Changed — The component that is compromised (the ingestion service) is distinct from the security authority (the host operating system and its secrets).
• Confidentiality: High — Arbitrary file disclosure of host-machine secrets.
• Integrity: High — Exfiltrated credentials can be used to alter system state.
• Availability: High — Compromised secrets (e.g., database credentials) can lead to full system compromise.

For an educational institution running Opencast, the blast radius includes:

• Compromise of the Opencast host and any co-located systems sharing credentials.
• Lateral movement into the campus network using disclosed secrets (LDAP bind credentials, database passwords, API tokens).
• Data breach of any sensitive data stored on the host.
• Academic integrity and privacy violations if student records, exam materials, or research data reside on the host.

The EPSS score of 0.01964 (78.4th percentile) indicates that this vulnerability is being actively examined by the threat intelligence community but has not yet been widely exploited. However, the low complexity and the broad privilege distribution in academic environments make mass exploitation plausible should exploit code become public.

Detection Guidance

The following detection rules target the observable behaviors associated with this vulnerability class. Since no public exploit code exists, these rules focus on the underlying primitives: anomalous file access patterns and ingestion activity involving non-standard media sources.

Sigma Rule

title: Opencast Local File Inclusion via Media Package
id: 8f70f7a1-2d2e-4f5c-9a8b-6c1e7f9a3b2c
status: experimental
description: Detects Opencast ingestion events referencing local file URLs, indicating potential CVE-2021-43821 exploitation.
logsource:
  product: linux
  service: auditd
detection:
  selection_ingest:
    type: 'INGEST'
  selection_file_read:
    key: '/etc/passwd'
  condition: selection_ingest and selection_file_read
level: high
falsepositives:
  - Legitimate system monitoring tools reading /etc/passwd
tags:
  - attack.t1190
  - cve.2021-43821

YARA Rule

rule Opencast_LocalFileInclusion
{
    meta:
        author = "valtersit.com TH-INTEL"
        description = "Detects Opencast media package manifests referencing file:// URLs"
        cve = "CVE-2021-43821"
        date = "2024-01-01"
        severity = "critical"
    strings:
        $file_scheme = "file://" ascii wide nocase
        $url_scheme = "url" ascii wide nocase
        $track = "track" ascii wide nocase
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2021-43821 Opencast Local File Inclusion Attempt"; flow:to_server,established; content:"file://"; http_uri; content:"ingest"; http_uri; classtype:attempted-admin; reference:cve,2021-43821; sid:10043821; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [file where process.name : "java" and event.action : "read" and file.name : ("*.conf", "*.key", "*.pem", "passwd", "shadow")]
  [network where process.name : "java" and event.action : "connection_attempted" and destination.port : "80"]

Splunk SPL Query

index=linux sourcetype=auditd
| search (type=INGEST OR type=PATH) AND (key="/etc/passwd" OR key="*.conf" OR key="*.pem" OR key="*.key")
| stats count by host, success, command, key
| sort -count

Wazuh OSSEC Rule

<rule id="100282" level="12">
  <decoded>auditd</decoded>
  <field name="type">INGEST</field>
  <field name="key">/etc/passwd</field>
  <description>Opencast media ingestion reading /etc/passwd - possible CVE-2021-43821 exploitation</description>
  <group>cve-2021-43821,opencast,file_read,</group>
  <mitre>
    <id>t1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. Despite the vendor advisory indicating fixes in Opencast 10.6 and 11.0, no patch commits or release artifacts have been confirmed from tracked sources. Treat all deployments as vulnerable until verified. Verify the running version — if it is below 10.6 (or below 9.10 for the 9.x line), assume the vulnerability is present.

Immediate Mitigations:

1. Restrict ingestion privileges. Review all accounts that have media-add or operator permissions. Remove stale accounts and limit ingestion rights to a minimal set of trusted administrators.
2. Harden filesystem access. Use UNIX file permissions and mandatory access control (SELinux/AppArmor) to narrow the read scope of the Opencast service account to only the directories it legitimately needs. The NVD description explicitly notes this cannot protect files Opencast must read, but it reduces the attack surface.
3. Network-layer filtering. Restrict access to the Opencast web interface to trusted networks or VPN users to reduce remote attacker exposure.
4. Monitor for anomalous ingestion. The detection rules above can be deployed immediately to identify file reads from sensitive paths by the Opencast process.

Patch/Upgrade Steps:

1. Verify the current Opencast version via the admin interface or GET /about API endpoint.
2. Upgrade to Opencast 10.6 or 11.0 as soon as the patched distribution is confirmed available from the vendor.
3. Test the upgrade in a staging environment, validating that ingestion workflows still function and that local file references are now rejected.
4. After upgrade, rotate all secrets that were readable by the Opencast process before the patch — database credentials, API keys, and TLS private keys — as they may have been exposed.

Long-Term Hardening:

1. Network segmentation. Isolate the Opencast host in a dedicated network zone with outbound egress filtering. The host should not have unrestricted access to internal database secrets or other campus infrastructure.
2. Credential isolation. Ensure the Opencast service account uses the least-privilege model. Do not run it as root or a privileged service account. Use dedicated credentials for database access.
3. File integrity monitoring. Deploy FIM on media storage and config directories to detect unauthorized modifications.
4. Periodic privilege audits. Regularly review who has ingestion and operator privileges; revoke unnecessary grants.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-43821 — Official NVD record.
2. CNA Advisory: Opencast Security Advisory — provided by the CNA; available via GitHub security advisories for the Opencast project.
3. Opencast Project: https://opencast.org — Official project site with release notes for versions 10.6 and 11.0, which contain the fix.
4. CWE-706: https://cwe.mitre.org/data/definitions/706.html — Use of Incorrectly-Resolved Name or Reference; classifies the underlying flaw.
5. EPSS Data: https://www.first.org/epss/ — Exploit Prediction Scoring System entry for CVE-2021-43821.

Known Campaigns / Exploit-in-the-Wild: No evidence of active exploitation in the wild has been observed as of this report. The EPSS percentile (78.4%) indicates elevated analytical interest but no confirmed exploitation campaigns. CISA KEV does not list this CVE.