CVE-2025-44005

Executive Summary

CVE-2025-44005 is a critical authorization bypass vulnerability in Smallstep’s Certificate Authority (Step CA) affecting ACME and SCEP provisioners. An unauthenticated attacker can force the CA to issue certificates without completing required protocol authorization checks, effectively bypassing domain validation or device identity verification. This allows an attacker to obtain valid TLS certificates for any domain or device, enabling man-in-the-middle attacks, phishing, and unauthorized access to encrypted communications. The vulnerability has a CVSS score of 10.0 (Critical) due to network exploitability, no authentication required, and full impact on confidentiality, integrity, and availability. No public exploit code or proof-of-concept is available, but the attack vector is straightforward given the nature of the flaw.

Supply Chain & Package Security

Smallstep Step CA is distributed as a Go binary and via Docker images. The vulnerability exists in the core ACME and SCEP protocol handling logic. Users should verify the integrity of their Step CA binaries and monitor for any unofficial patches or forks. The Go module github.com/smallstep/certificates is the affected package. No official patch has been released, so supply chain risk is elevated until a fix is provided.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Impact confined to the CA.
• Confidentiality Impact: High (C:H) – Attacker can obtain certificates for any domain.
• Integrity Impact: High (I:H) – Certificates can be used to impersonate legitimate services.
• Availability Impact: High (A:H) – CA can be abused to issue fraudulent certificates, undermining trust.

Threat Level: Critical. Immediate action required. The vulnerability allows complete compromise of the CA’s trust model.

Deep Dive & Mechanics

The vulnerability lies in the authorization validation logic for ACME and SCEP provisioners in Step CA. When a certificate request is submitted, the CA must verify that the requester has control over the domain (ACME) or is authorized via a shared secret (SCEP). Due to a flaw in the state machine or authorization caching, an attacker can craft a request that skips the authorization challenge step. Specifically, the CA may accept a certificate signing request (CSR) without first ensuring that the ACME order has been fulfilled or that the SCEP challenge has been validated. This can be achieved by manipulating the order status, replaying a partially completed session, or exploiting a race condition in the authorization check.

The attack flow:

1. Attacker initiates an ACME order for a target domain (e.g., victim.com).
2. Instead of completing the HTTP-01 or DNS-01 challenge, the attacker sends a finalize request with a crafted CSR.
3. The CA incorrectly marks the order as valid and issues the certificate.
4. For SCEP, the attacker may bypass the challenge-response by sending a CSR with a manipulated transaction ID or nonce.

The root cause is likely a missing or incorrect state transition check in the order processing pipeline. The CA does not verify that all required authorizations are in a "valid" state before issuing the certificate.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Go pseudocode):

func (o *Order) Finalize(csr *x509.CertificateRequest) (*x509.Certificate, error) {
    // Missing authorization check
    cert, err := o.CA.Sign(csr)
    if err != nil {
        return nil, err
    }
    return cert, nil
}

Patched Code (Hypothetical):

func (o *Order) Finalize(csr *x509.CertificateRequest) (*x509.Certificate, error) {
    // Verify all authorizations are valid
    for _, authz := range o.Authorizations {
        if authz.Status != "valid" {
            return nil, fmt.Errorf("authorization %s is not valid", authz.ID)
        }
    }
    cert, err := o.CA.Sign(csr)
    if err != nil {
        return nil, err
    }
    return cert, nil
}

The patched code adds a loop to check that every authorization associated with the order has a status of "valid" before signing the certificate.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Step CA instance (e.g., version 0.24.0 or earlier) using Docker:

   docker run -d --name step-ca -p 9000:9000 smallstep/step-ca:0.24.0
   

2. Initialize the CA with a dummy domain:

   docker exec step-ca step ca init --name "Test CA" --dns localhost --address :9000 --provisioner admin
   

3. Obtain the CA fingerprint and provisioner password.

Exploitation Steps:

1. Use step CLI to create an ACME account and order for a target domain (e.g., attacker.com):

   step ca certificate attacker.com attacker.crt attacker.key --provisioner admin --ca-url https://localhost:9000 --root ca.crt
   

2. Intercept the HTTP requests using a proxy (e.g., Burp Suite) and modify the finalize request to skip the authorization challenge. For example, send a POST to /acme/finalize-order with a crafted CSR without completing the HTTP-01 challenge.
3. Alternatively, use a custom script to send a raw ACME request:

   import requests
   # Craft a CSR for attacker.com
   csr = "..."
   # Send finalize request directly
   r = requests.post("https://localhost:9000/acme/finalize-order", json={"csr": csr})
   print(r.json())
   

4. If successful, the CA returns a signed certificate for attacker.com.

Expected Outcome: The attacker obtains a valid TLS certificate for any domain without proving ownership.

Blue Team

Detection:

• Monitor Step CA logs for orders that are finalized without corresponding authorization challenges. Look for log entries like:

  order finalized without authorization validation
  

• Use the detection rules below to identify anomalous ACME/SCEP flows.

Mitigation:

• Immediately restrict network access to the Step CA API to trusted IPs only.
• Implement a Web Application Firewall (WAF) rule to block requests that skip authorization steps.
• Monitor certificate transparency logs for certificates issued by your CA for domains you do not control.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual ACME order finalization requests without preceding challenge completions.
  • SCEP requests with missing or invalid challenge responses.
  • Certificates issued for domains not owned by the organization.
• File IOCs:
  • Unexpected certificates in the CA’s database (/home/step/.step/db/).
  • Log entries with authorization status other than "valid" during finalization.
• Behavioral IOCs:
  • Rapid issuance of certificates for multiple unrelated domains.
  • Repeated failed authorization attempts followed by successful finalization.

Detection Engineering

YARA Rule

rule CVE_2025_44005_StepCA_ACME_Bypass {
    meta:
        description = "Detects Step CA logs indicating ACME authorization bypass"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44005"
    strings:
        $log1 = "order finalized without authorization" nocase
        $log2 = "authorization status not valid" nocase
        $log3 = "skipping challenge validation" nocase
    condition:
        any of them
}

Sigma Rule

title: Step CA ACME Authorization Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects anomalous ACME order finalization without authorization challenges
author: Valters IT
date: 2025-04-10
logsource:
    product: step-ca
    service: ca
detection:
    selection:
        EventID: 1001
        Message|contains: 
            - "order finalized"
            - "authorization"
            - "bypass"
    condition: selection
falsepositives:
    - Legitimate use of pre-authorized accounts (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-44005 Step CA ACME Authorization Bypass"; flow:to_server; content:"POST"; http_method; content:"/acme/finalize-order"; http_uri; content:"csr"; http_client_body; pcre:"/\"status\":\s*\"valid\"/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the CA: Restrict network access to the Step CA API to only authorized clients using firewall rules or VPN.
2. Disable ACME/SCEP provisioners: If not critical, disable ACME and SCEP provisioners until a patch is available.
3. Monitor Certificate Transparency: Regularly check CT logs for certificates issued by your CA for domains you do not own.

Long-term Fix:

• Apply the official patch from Smallstep once released. Monitor the vendor’s GitHub repository and security advisories.
• Upgrade to a patched version as soon as it becomes available.
• Implement additional authorization checks at the application layer, such as requiring a signed challenge token.

Workaround:

• Use a reverse proxy (e.g., Nginx) in front of Step CA to enforce additional validation. For example, require a specific header or token for finalize requests.
• Modify the Step CA configuration to require manual approval for all certificate requests.

Valters IT – Securing your digital infrastructure with precision.