CyberRota Analysis
AI-GeneratedA flaw in the pki-core's v2 REST ACL filter allows a wildcard-mapped permission to override a more specific literal-mapped permission, leading to unauthorized access in the profile-management REST API. This vulnerability could enable users with lower privileges to perform actions intended for administrators, compromising the confidentiality and integrity of the certificate authority's issuance policy. Organizations utilizing pki-core for certificate management should prioritize addressing this issue to safeguard their security posture.
Original NVD Description
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.