Description

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T13:19:47.067Z",
  "pubdate": "2026-09-01T13:19:47.067Z",
  "executiveSummary": "This vulnerability involves an Improper Access Control flaw within the Security Domain hosts inventory endpoint, specifically accessible via the GET /ca/rest/securityDomain/hosts path. The vulnerability allows unauthenticated remote attackers to enumerate internal PKI (Public Key Infrastructure) and CA (Certificate Authority) infrastructure, including system roles and network topology.\nThe primary impact is unauthorized reconnaissance, where an attacker can gain critical architectural knowledge of the security domain. By exposing the identities, roles, and interdependencies of participating subsystems, the vulnerability facilitates targeted reconnaissance for subsequent attacks against the PKI infrastructure. Because the endpoint does not enforce authentication, client certificate validation, or session management, any network-adjacent or external actor capable of reaching the service can extract sensitive configuration data without leaving authentication logs.\nThis exposure violates the principle of least privilege and significantly lowers the barrier for adversaries attempting to map the internal security perimeter, potentially leading to unauthorized data exfiltration, service disruption, or further exploitation of PKI components. There are no known exploitation requirements beyond network connectivity to the target service.",
  "technicalDetails": "The vulnerability resides within the application's REST API layer, specifically governing access to the Security Domain inventory service. The endpoint GET /ca/rest/securityDomain/hosts fails to implement mandatory authentication checks, effectively bypassing the security controls that should restrict access to administrative or highly sensitive diagnostic functions.\nRoot Cause: The root cause is an Authorization Bypass (CWE-862) caused by the absence of access control middleware or restrictive security constraints on the /ca/rest/securityDomain/hosts resource. The application framework fails to validate the presence of a principal, a valid client certificate, or an active session token before processing the request and returning the serialized inventory data.\nAttack Flow: 1. Reconnaissance: An attacker identifies the target PKI/CA system and probes for RESTful API endpoints. 2. Request: The attacker sends a standard HTTP GET request to /ca/rest/securityDomain/hosts without providing credentials, API keys, or TLS client certificates. 3. Processing: The application, failing to verify the identity of the requester, proceeds to invoke the internal handler responsible for querying the Security Domain inventory database. 4. Response: The application retrieves the structured response containing the full list of participating PKI/CA hosts, their assigned roles, and internal network architecture details. 5. Exfiltration: The server transmits this highly sensitive telemetry to the unauthenticated attacker, providing a detailed blueprint of the security environment.\nPayload and Impact: The returned data provides deep insight into the internal topology, identifying specific servers dedicated to Certificate Authority functions, registration authorities, or secondary PKI nodes. This intelligence allows an adversary to correlate internal IP addresses with specific security functions. Consequently, this mapping can be weaponized in multi-stage attacks, such as targeted Denial-of-Service (DoS) against critical CA nodes, or the selection of high-value targets for lateral movement within the PKI infrastructure. Because this information is sensitive internal infrastructure telemetry, its public or unauthorized disclosure essentially weaponizes the target's internal design against itself, enabling more effective exploitation of subsequent vulnerabilities within the PKI stack."
}