CVE-2024-42490

Executive Summary

CVE-2024-42490 is a missing authorization vulnerability in authentik, an open-source Identity Provider. Several API endpoints, including /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/, and /api/v3/.../used_by/, can be accessed by unauthenticated or unauthorized users. While the endpoints require knowledge of a UUIDv4 object ID (which is not easily guessable), an attacker who discovers or enumerates a valid UUID can retrieve sensitive certificate data, including private keys. The CVSS score is 7.5 (High), with a vector emphasizing network-based, low-complexity exploitation without privileges. The EPSS score is 0.0%, indicating low current exploitation activity, but the potential impact on confidentiality is severe. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects the authentik application itself, which is distributed as a Docker image and via GitHub releases. There is no direct impact on NPM, PyPI, Go, or Ruby packages. However, organizations using authentik as part of their identity infrastructure should verify the integrity of their deployment artifacts and ensure they are sourced from official channels.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the potential for unauthorized access to sensitive cryptographic material, including private keys. Although exploitation requires knowledge of a UUID, the low attack complexity and lack of required privileges make this a significant risk.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks on several API endpoints in authentik. The affected endpoints are:

• /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/
• /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/
• /api/v3/.../used_by/

These endpoints are designed to be accessible only to authenticated and authorized users (e.g., administrators). However, due to a lack of proper access control, any user (including unauthenticated ones) can access these endpoints if they know the UUID of the target object.

The UUIDs used are UUIDv4, which are random and not easily guessable. However, an attacker could potentially enumerate UUIDs through other means (e.g., information disclosure, brute-force in a constrained environment, or by obtaining a list of UUIDs from a compromised system). Once a valid UUID is known, the attacker can retrieve:

• Certificate data: The public certificate, which may reveal organizational details.
• Private key: The most critical impact, as it allows the attacker to impersonate the service, decrypt traffic, or sign malicious data.
• Used-by relationships: Information about which objects reference the certificate, aiding further attacks.

The vulnerability is present in versions prior to 2024.4.4, 2024.6.4, and 2024.8.0.

Vulnerable vs. Patched Code

The fix involves adding authorization checks to the affected API endpoints. Below is a conceptual comparison.

Vulnerable Code (Python/DRF example):

class CertificateKeyPairViewSet(viewsets.ModelViewSet):
    queryset = CertificateKeyPair.objects.all()
    serializer_class = CertificateKeyPairSerializer

    @action(detail=True, methods=['get'])
    def view_certificate(self, request, pk=None):
        instance = self.get_object()
        # Missing authorization check
        return Response(instance.certificate)

Patched Code:

class CertificateKeyPairViewSet(viewsets.ModelViewSet):
    queryset = CertificateKeyPair.objects.all()
    serializer_class = CertificateKeyPairSerializer
    permission_classes = [IsAuthenticated & IsAdminUser]  # Added permission

    @action(detail=True, methods=['get'])
    def view_certificate(self, request, pk=None):
        instance = self.get_object()
        self.check_object_permissions(request, instance)  # Added check
        return Response(instance.certificate)

The patch ensures that only authenticated users with appropriate permissions (e.g., admin) can access these endpoints.

Exploitation & Lab Setup

Red Team

Objective: Exploit the missing authorization to retrieve a private key.

Prerequisites:

• Knowledge of a valid UUID for a certificate key pair.
• Network access to the authentik API.

Steps:

1. Identify a target UUID: This could be obtained through information disclosure, social engineering, or by analyzing network traffic. For example, if a user has access to a certificate's public information, the UUID might be exposed in a URL.

2. Craft the request: Use a tool like curl to access the private key endpoint.

   curl -X GET "https://target.example.com/api/v3/crypto/certificatekeypairs/<UUID>/view_private_key/"
   

3. Retrieve the private key: If the request succeeds, the response will contain the private key in PEM format.

   {
     "key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQ..."
   }
   

4. Use the private key: The attacker can now decrypt traffic, sign tokens, or impersonate the service.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Objective: Detect and prevent exploitation.

Detection:

• Monitor API access logs for requests to /api/v3/crypto/certificatekeypairs/ without prior authentication.
• Alert on multiple failed attempts to access different UUIDs (potential enumeration).
• Use the Sigma rule provided in the Detection Engineering section.

Prevention:

• Apply the patch immediately by upgrading to authentik 2024.4.4, 2024.6.4, or 2024.8.0.
• Implement network segmentation to restrict API access to trusted IPs.
• Enable logging and monitoring for all API endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/ from unauthenticated sources.
  • Repeated 401/403 responses followed by a 200 response to the same endpoint (successful exploitation after enumeration).
• File IOCs:
  • Unexpected private key files (PEM format) appearing in logs or temporary directories.
• Behavioral IOCs:
  • Unusual decryption of TLS traffic or signing of tokens using a compromised key.

Detection Engineering

YARA Rule

rule Detect_Authentik_Private_Key_Exposure {
    meta:
        description = "Detects exposure of private keys via CVE-2024-42490"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-42490"
    strings:
        $private_key = "-----BEGIN PRIVATE KEY-----"
        $api_endpoint = "/api/v3/crypto/certificatekeypairs/"
    condition:
        $private_key and $api_endpoint
}

Sigma Rule

title: Authentik Unauthorized Private Key Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized access to private key endpoints in authentik
author: Valters IT
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/api/v3/crypto/certificatekeypairs/'
        cs-uri-stem|contains: '/view_private_key/'
    condition: selection
falsepositives:
    - Legitimate admin access
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-42490 - Authentik Private Key Access Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/api/v3/crypto/certificatekeypairs/";
    http_uri;
    content:"/view_private_key/";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Patch: Upgrade to authentik 2024.4.4, 2024.6.4, or 2024.8.0. These versions include the necessary authorization checks.
2. Workaround: If immediate patching is not possible, restrict network access to the API endpoints using a Web Application Firewall (WAF) or reverse proxy rules. For example, in Nginx:

   location ~ ^/api/v3/crypto/certificatekeypairs/ {
       deny all;
       return 403;
   }
   

3. Rotate Secrets: If there is any indication that private keys were exposed, revoke and regenerate all affected certificates and keys.
4. Monitor Logs: Review access logs for any suspicious activity targeting the affected endpoints.
5. Audit Permissions: Ensure that all API endpoints have proper authorization checks in place.

Valters IT