Description

An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-01T12:17:35.300Z",
  "pubdate": "2026-09-01T12:17:35.300Z",
  "executiveSummary": "This vulnerability involves a resource exhaustion vector within the Dogtag Certificate System (CA) REST interface, specifically exposed via IdM through an Apache proxy. The issue stems from improper error handling in the POST /ca/rest/certrequests endpoint, which triggers verbose Java stack trace generation upon receipt of malformed, unauthenticated requests.\nBy repeatedly sending specially crafted requests, an unauthenticated remote attacker can force the system to write extensive multi-line error logs to the server's disk. This mechanism facilitates a Denial of Service (DoS) attack through log-amplification, causing rapid disk space exhaustion and significant I/O contention on the host system.\nThe vulnerability affects the IdM-integrated Dogtag CA deployment and requires no prior authentication or elevated privileges for exploitation. The risk implication is high, as the attack vector is exposed via the network to any party capable of reaching the IdM REST interface. Successful exploitation directly threatens the availability and stability of the CA infrastructure and associated management services.",
  "technicalDetails": "The root cause of this vulnerability lies in the exception handling logic within the Dogtag CA REST API framework. When the POST /ca/rest/certrequests endpoint receives malformed input, the application fails to gracefully handle the invalid request parameters before the processing logic triggers an unhandled exception.\nThe attack flow initiates when an unauthenticated actor sends an HTTP POST request containing malicious or malformed payloads to the /ca/rest/certrequests endpoint. Because the IdM infrastructure proxies this request directly to the Dogtag backend, the request reaches the vulnerable Java-based REST component without initial validation by the proxy layer.\nUpon reaching the application layer, the malformed input triggers an internal server error (HTTP 500). Instead of returning a sanitized response code or a minimized error message, the application executes a global exception handler that serializes the entire Java stack trace and writes it to the CA debug log. Because the stack trace is multi-line and highly verbose, each failed request results in a disproportionately large entry in the log file relative to the size of the initial request packet.\nAn attacker can automate the submission of these malformed requests at a high frequency, effectively creating an amplification effect. Since the application is synchronous in its logging operations, the volume of writes induces significant disk I/O contention, which degrades the performance of the entire IdM environment. Simultaneously, the sustained high-rate logging leads to rapid growth of log files, which, if left unmanaged, results in total exhaustion of the storage partition hosting the CA log directory.\nThe vulnerability is persistent across configurations where the REST endpoint is exposed via the Apache proxy. No session state or authentication tokens are required to trigger the error path. The post-exploitation impact is twofold: immediate service degradation due to I/O saturation and a sustained DoS condition triggered by disk space depletion, which often necessitates manual intervention by administrators to clear logs and restore service availability."
}