CyberRota Analysis
AI-GeneratedA vulnerability exists in the Dogtag PKI's CMCAuthForEST authentication plugin, which improperly handles enrollment requests submitted via BasicAuth without requiring an end-user TLS client certificate. This flaw allows authenticated users to exploit the system, potentially obtaining CA-signed certificates with arbitrary subject names, leading to unauthorized access and privilege escalation. Organizations utilizing Dogtag PKI should prioritize addressing this issue to mitigate the risk of certificate misuse and ensure proper authentication controls.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.