PT-2021-21256 · Unknown · Emissary-Ingress

Ropnop · Published 2021-07-09 · Updated 2021-07-14 · CVE-2021-36371

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Emissary-Ingress (formerly Ambassador API Gateway) versions 1.13.9 and earlier

Description The issue allows attackers to bypass client certificate requirements on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate authentication. The attacker must send an SNI specifying an unprotected backend and an HTTP Host header specifying a protected backend.

Recommendations For Emissary-Ingress (formerly Ambassador API Gateway) versions 1.13.9 and earlier, consider updating to a version where this issue is fixed, or apply configuration changes to ensure that all TLSContext definitions require client certificate authentication. As a temporary workaround, consider restricting access to backend upstreams that do not require client certificate authentication to minimize the risk of exploitation.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2021-36371

Affected Products

Emissary-Ingress

References · 7

• 🔥 https://github.com/emissary-ingress/emissary/issues/3340 · Exploit
• https://osv.dev/vulnerability/CVE-2021-36371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36371 · Security Note
• https://github.com/emissary-ingress/emissary/releases/tag/v2.0.0-ea · Note
• https://t.me/cvenotify/17399 · Telegram Post
• https://t.me/cibsecurity/26047 · Telegram Post
• https://t.me/cvenotify/17366 · Telegram Post