CVE-2021-3034: Cortex XSOAR Information Disclosure Flaw

CVE-2021-3034 Overview

An information exposure through log file vulnerability exists in Palo Alto Networks Cortex XSOAR software where sensitive SAML single sign-on (SSO) integration secrets can be inadvertently logged to the /var/log/demisto/ server logs during integration testing and setup. This vulnerability affects organizations using SAML-based authentication for their SOAR platform, potentially exposing critical cryptographic materials to unauthorized access.

Critical Impact

SAML SSO private keys and identity provider certificates may be exposed in server logs, enabling potential authentication bypass and impersonation attacks against the Cortex XSOAR platform.

Affected Products

• Cortex XSOAR 5.5.0 builds earlier than 98622
• Cortex XSOAR 6.0.1 builds earlier than 830029
• Cortex XSOAR 6.0.2 builds earlier than 98623
• Cortex XSOAR 6.1.0 builds earlier than 848144

Discovery Timeline

• 2021-03-10 - CVE CVE-2021-3034 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3034

Vulnerability Analysis

This vulnerability falls under the category of Information Exposure through Log Files (CWE-532). The core issue lies in the SAML SSO integration testing functionality within Cortex XSOAR. When administrators configure and test SAML authentication during initial setup or subsequent modifications, the application fails to properly sanitize or redact sensitive authentication materials before writing diagnostic information to server logs.

The exposed information includes the private key used for SAML assertion signing and the identity provider (IdP) certificate. These cryptographic materials are fundamental to the security of SAML-based authentication. An attacker with access to the log files could potentially forge SAML assertions, impersonate users, or compromise the trust relationship between the service provider (Cortex XSOAR) and the identity provider.

The local attack vector requires an adversary to have existing access to the server's file system, specifically the ability to read files within the /var/log/demisto/ directory. While this limits the immediate attack surface, it poses significant risk in environments where log aggregation systems collect and potentially expose these logs to a broader audience, or where insider threats exist.

Root Cause

The root cause of this vulnerability is inadequate data sanitization in the logging mechanism during SAML SSO integration testing. The application's debug or diagnostic logging routines capture the full configuration data, including sensitive cryptographic secrets, without implementing proper redaction or filtering. This is a common oversight in security-sensitive applications where verbose logging for troubleshooting purposes inadvertently captures sensitive data that should never persist in plaintext form on disk.

Attack Vector

Exploitation of this vulnerability requires local access to the affected Cortex XSOAR server with sufficient privileges to read log files in /var/log/demisto/. The attack scenario typically involves:

1. An attacker gains access to the server hosting Cortex XSOAR (through separate compromise or insider access)
2. The attacker navigates to the log directory and searches for SAML-related configuration data
3. Once the private key and IdP certificate are extracted, the attacker can craft forged SAML assertions
4. These forged assertions can be used to authenticate as any user, including administrators

The vulnerability is particularly concerning in environments where SAML integration testing occurred during initial deployment, as the sensitive data may have been persisting in logs for extended periods before discovery.

Detection Methods for CVE-2021-3034

Indicators of Compromise

• Unexpected access to log files within the /var/log/demisto/ directory by unauthorized users or processes
• Log entries containing Base64-encoded certificate data or PEM-formatted private keys
• Anomalous SAML authentication events from unexpected network locations or at unusual times
• Modifications to SAML SSO configurations without corresponding change management records

Detection Strategies

• Implement file integrity monitoring (FIM) on the /var/log/demisto/ directory to detect unauthorized access
• Configure log analysis tools to alert on patterns matching private key headers (e.g., -----BEGIN PRIVATE KEY-----)
• Monitor authentication logs for SAML assertions that don't originate from legitimate identity provider infrastructure
• Deploy endpoint detection to identify processes reading or copying log files outside normal operational patterns

Monitoring Recommendations

• Enable audit logging for all file access operations on the Cortex XSOAR server log directories
• Integrate Cortex XSOAR server logs with a SIEM platform to correlate suspicious access patterns
• Establish baseline behavior for legitimate administrative access to log files and alert on deviations
• Periodically review log retention policies to minimize the exposure window for sensitive data

How to Mitigate CVE-2021-3034

Immediate Actions Required

• Upgrade Cortex XSOAR to a patched version immediately: 5.5.0 build 98622+, 6.0.1 build 830029+, 6.0.2 build 98623+, or 6.1.0 build 848144+
• Rotate SAML SSO private keys and certificates after upgrading to prevent exploitation of previously exposed credentials
• Review and purge historical log files in /var/log/demisto/ that may contain exposed secrets
• Restrict file system permissions on log directories to minimize the attack surface

Patch Information

Palo Alto Networks has released patched versions addressing this vulnerability. Organizations should upgrade to the following minimum build versions:

• Cortex XSOAR 5.5.0: Build 98622 or later
• Cortex XSOAR 6.0.1: Build 830029 or later
• Cortex XSOAR 6.0.2: Build 98623 or later
• Cortex XSOAR 6.1.0: Build 848144 or later

Refer to the Palo Alto Networks Security Advisory for detailed upgrade instructions and download links.

Workarounds

• Restrict access to the /var/log/demisto/ directory using strict file system permissions (e.g., chmod 700)
• If SAML SSO is not actively required, temporarily disable the integration until patching is complete
• Implement network segmentation to limit access to Cortex XSOAR servers from untrusted network zones
• Configure log rotation with short retention periods to minimize exposure of sensitive data in logs

# Configuration example: Restrict log directory permissions
sudo chmod 700 /var/log/demisto/
sudo chown demisto:demisto /var/log/demisto/

# Search for potentially exposed secrets in existing logs
grep -r "BEGIN.*PRIVATE KEY\|BEGIN CERTIFICATE" /var/log/demisto/

# Securely delete logs containing exposed secrets after backup
find /var/log/demisto/ -type f -name "*.log" -exec shred -u {} \;