CVE-2021-32958 : Security Advisory and Response

Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel is a vulnerability that affects versions 3.0 through 3.2 of the Secure Remote Access (SRA) Site by Claroty. The vulnerability allows an attacker with local command line interface access to obtain the secret key and generate valid session tokens for the web UI. This could lead to unauthorized access and compromise of the installation.

Understanding CVE-2021-32958

This section provides an overview of the CVE-2021-32958 vulnerability affecting Claroty's Secure Remote Access Site.

What is CVE-2021-32958?

CVE-2021-32958 is an authentication bypass vulnerability that exists in Claroty Secure Remote Access (SRA) Site versions 3.0 through 3.2. It allows attackers with local access to gain the secret key and generate valid session tokens, potentially compromising the SRA installation.

The Impact of CVE-2021-32958

The successful exploitation of this vulnerability could enable unauthorized individuals to access assets managed by the SRA installation, leading to potential compromise of sensitive information.

Technical Details of CVE-2021-32958

In the technical analysis of CVE-2021-32958, the following details have been identified:

Vulnerability Description

The vulnerability in versions 3.0 through 3.2 of Claroty's Secure Remote Access (SRA) Site allows attackers with local CLI access to retrieve the secret key, subsequently enabling them to generate valid session tokens for the web UI.

Affected Systems and Versions

Claroty Secure Remote Access (SRA) Site versions 3.0 through 3.2 are impacted by this vulnerability.

Exploitation Mechanism

Attackers with local command line interface access can exploit this vulnerability to gain the secret key, generate valid session tokens, and potentially compromise the SRA installation.

Mitigation and Prevention

To address CVE-2021-32958, the following mitigation strategies can be implemented:

Immediate Steps to Take

Upgrade to a patched version of Claroty Secure Remote Access (SRA) Site that addresses the vulnerability.
Monitor and restrict access to the local CLI to prevent unauthorized retrieval of the secret key.

Long-Term Security Practices

Implement strong access control measures to limit unauthorized access to critical systems.
Regularly update and patch software to mitigate known vulnerabilities.

Patching and Updates

Stay informed about security advisories and updates from Claroty to ensure the timely application of patches that address CVE-2021-32958.