CVE-2025-66406

Executive Summary

CVE-2025-66406 is an improper authorization vulnerability in Smallstep's Step CA, an online certificate authority used for automated certificate management in DevOps environments. The flaw specifically affects deployments using the SSHPOP provisioner, allowing an attacker with valid SSH certificate issuance privileges to improperly revoke SSH certificates. This could lead to denial of service or disruption of SSH-based authentication workflows. The vulnerability is fixed in Step CA version 0.29.0.

Supply Chain & Package Security

This vulnerability affects the Go-based Step CA binary. Organizations using Step CA in their CI/CD pipelines or infrastructure automation should verify their deployment version and update to 0.29.0 or later. The package is distributed via GitHub releases and official Docker images.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for valid credentials (low privileges) but the potential to disrupt SSH certificate management operations.

Deep Dive & Mechanics

The vulnerability resides in the SSHPOP provisioner's authorization logic for SSH certificate revocation. The SSHPOP provisioner is designed to allow SSH certificate issuance and revocation based on specific authorization checks. In vulnerable versions (< 0.29.0), the revocation endpoint does not properly validate that the requesting user has the authority to revoke a given SSH certificate. This allows an authenticated user with SSH certificate issuance rights to revoke certificates they should not be able to revoke, potentially including certificates belonging to other users or systems.

The improper authorization check occurs in the revocation handler, where the system fails to verify that the certificate being revoked was issued to the same principal or under the same authorization scope as the requester. This bypasses the intended access control mechanism.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.29.0):

func (p *SSHPOPProvisioner) Revoke(ctx context.Context, cert *x509.Certificate) error {
    // Missing authorization check - assumes any authenticated user can revoke any certificate
    return p.db.RevokeCertificate(ctx, cert)
}

Patched Code (0.29.0+):

func (p *SSHPOPProvisioner) Revoke(ctx context.Context, cert *x509.Certificate, principal string) error {
    // Verify that the requester is authorized to revoke this certificate
    if cert.Subject.CommonName != principal {
        return fmt.Errorf("unauthorized: cannot revoke certificate for %s", cert.Subject.CommonName)
    }
    return p.db.RevokeCertificate(ctx, cert)
}

The patched version adds a principal check to ensure the requester can only revoke certificates issued to themselves.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker with valid SSH certificate issuance credentials can craft a revocation request for any SSH certificate managed by the Step CA instance.

Proof of Concept:

# Assume attacker has a valid SSH certificate and token for the SSHPOP provisioner
# Step 1: Obtain a valid token for the SSHPOP provisioner
TOKEN=$(step oauth --provider=sshpop --issuer=https://ca.example.com)

# Step 2: Revoke a target certificate (e.g., for user "admin")
step certificate revoke --ca-url https://ca.example.com --root root.crt --token $TOKEN admin.crt

This would succeed even if the attacker should not have authority to revoke the "admin" certificate.

Blue Team

Detection and Prevention:

1. Monitor Step CA logs for unexpected revocation events:

grep "revoke" /var/log/step-ca.log | grep -v "authorized"

2. Implement network segmentation to restrict access to the Step CA API.

3. Enable audit logging and alert on revocation events for privileged users.

4. Use the following Suricata rule to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Log Entries: Step CA logs showing revocation of certificates by unauthorized principals.
• Network Traffic: HTTP POST requests to /revoke endpoint with unexpected certificate subjects.
• File Artifacts: Modified certificate revocation lists (CRLs) containing unexpected entries.

Detection Engineering

YARA Rule

rule CVE_2025_66406_StepCA_Revocation_Abuse {
    meta:
        description = "Detects exploitation attempts of CVE-2025-66406 in Step CA logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66406"
    strings:
        $revoke = "revoke" nocase
        $unauthorized = "unauthorized" nocase
        $sshpop = "sshpop" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-66406 Step CA Unauthorized SSH Certificate Revocation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized SSH certificate revocation attempts against Step CA
author: Valters IT
logsource:
    product: step-ca
    service: audit
detection:
    selection:
        EventID: 4624
        TargetUserName: '*'
        ProcessName: '*step-ca*'
        CommandLine: '*revoke*'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66406 Step CA Unauthorized SSH Certificate Revocation"; flow:to_server; content:"POST"; http_method; content:"/revoke"; http_uri; content:"sshpop"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Step CA to version 0.29.0 or later.
2. Workaround: If upgrade is not possible, restrict access to the SSHPOP provisioner's revocation endpoint using network ACLs or reverse proxy rules.
3. Monitoring: Enable detailed audit logging for all certificate operations and monitor for anomalous revocation patterns.
4. Validation: Regularly audit certificate revocation lists for unauthorized entries.

Valters IT signature: This report is generated for educational and defensive purposes. Always verify with official sources before taking action.