Horizon Alert
Summary of the vulnerability and why it matters
A security vulnerability has been identified in Keyfactor EJBCA software, specifically concerning how administrator access is handled. When an administrator's role is changed, there's a possibility that the system might continue to grant them access longer than intended, even after their administrative privileges have been revoked. This could potentially allow unauthorized access to sensitive functions within the system.
- Former administrators may retain access unexpectedly.
- Protects sensitive certificate management functions.
- Confirm relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this issue by removing an administrator's role while they have an active TLS session. EJBCA might then continue to authenticate the removed administrator for a period beyond the intended limit, allowing them to retain unauthorized access to the system.
- No authentication required.
- Administrator role removal during active session.
- Unauthorized access to EJBCA.
Live Threat
Current exploitation, exposure, and threat context
When an administrator is removed from their role while logged in, Keyfactor EJBCA may, under specific conditions, continue to grant access for a period exceeding the configured session timeout. This could allow a former administrator to retain unauthorized access to the system.
- Administrator session data.
- Cached authentication may permit continued access.
- Unauthorized access to PKI management.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Keyfactor EJBCA authentication caching issue, a critical vulnerability, likely impacts platform teams managing PKI infrastructure, as well as security teams responsible for access control. The immediate priority is to identify all instances of EJBCA, confirm their network reachability and business criticality, and then pinpoint the accountable owner. Planning remediation should follow, prioritizing environments with the highest exposure and impact.
- Platform and security teams own resolution.
- Verify EJBCA network exposure and criticality.
- Plan access control and session management updates.
