CVE-2025-3027: Primekey EJBCA Redirect Vulnerability

CVE-2025-3027 Overview

CVE-2025-3027 is an open redirect vulnerability affecting PrimeKey EJBCA Enterprise version 8.0. The flaw resides in URL path handling within the EJBCA service. When an attacker modifies the PATH component of a service URL, the server fails to locate the requested file and redirects the client to an external page. This behavior maps to CWE-601: URL Redirection to Untrusted Site. Attackers can weaponize the redirect to send victims from a trusted EJBCA endpoint to attacker-controlled infrastructure, enabling phishing and credential harvesting campaigns against certificate authority administrators.

Critical Impact
Attackers can abuse the trusted EJBCA URL to redirect PKI administrators to malicious sites, facilitating phishing attacks against a high-value certificate authority interface.

Affected Products

PrimeKey EJBCA Enterprise 8.0
EJBCA service endpoints exposed on the network
Deployments using default URL routing configurations

Discovery Timeline

2025-03-31 - CVE-2025-3027 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3027

Vulnerability Analysis

The vulnerability exists in how the EJBCA service resolves URL paths for its web endpoints. A small modification to the PATH of a service URL causes the server to fail file lookup and issue an HTTP redirect to an external destination. Because the redirect target is derived from user-controlled input without validation against an allowlist, the response effectively becomes an unvalidated redirect. The issue falls under CWE-601.

EJBCA operates as a certificate authority platform used to issue and manage X.509 certificates. Its administrative and RA (Registration Authority) interfaces are trusted by operators handling sensitive PKI workflows. An open redirect on this platform carries elevated impact because the affected hostname is treated as authoritative by staff and automated tooling.

No public proof-of-concept exploit or CISA KEV listing is associated with this CVE at the time of writing.

Root Cause

The root cause is improper handling of malformed or unresolved URL paths within the EJBCA request router. Rather than returning a 404 Not Found or generic error page, the service produces a redirect response containing a location value influenced by the request. The redirection logic does not enforce that the destination remains within the EJBCA origin or a preapproved list of hosts.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL pointing to a legitimate EJBCA service endpoint with a slightly altered PATH. The attacker delivers the URL through email, chat, or a compromised web page. When the target opens the link, the EJBCA server responds with a redirect that sends the browser to an attacker-controlled site. The victim's browser retains the impression that the original request went to the trusted CA host.

The vulnerability is documented in the INCIBE Security Notice on EJBCA Vulnerabilities, which describes the redirection behavior in prose. No verified exploit code has been published.

Detection Methods for CVE-2025-3027

Indicators of Compromise

HTTP 302 or 301 responses from EJBCA endpoints containing a Location header pointing to external hostnames
Web server access logs showing repeated requests to EJBCA paths with unusual suffixes, prefixes, or encoded characters
Referrer headers on external phishing sites showing the EJBCA hostname as the origin
Reports from users describing unexpected navigation away from EJBCA administrative pages

Detection Strategies

Inspect EJBCA reverse proxy and application logs for redirect responses whose Location values do not match the EJBCA origin
Deploy web application firewall rules that flag PATH manipulations on known EJBCA URIs
Correlate outbound DNS lookups from administrator workstations following visits to EJBCA URLs against threat intelligence feeds

Monitoring Recommendations

Enable verbose HTTP request and response logging on the EJBCA application server and forward logs to a centralized analytics platform
Alert on any 3xx response from EJBCA where the redirect target hostname differs from the configured service FQDN
Track user-reported phishing attempts referencing the EJBCA hostname and cross-reference with server logs

How to Mitigate CVE-2025-3027

Immediate Actions Required

Inventory all EJBCA Enterprise 8.0 deployments and confirm exposure of the affected service endpoints
Restrict network access to the EJBCA administrative and RA interfaces to trusted management networks and VPN users
Notify PKI administrators and RA officers about the phishing risk and instruct them to verify URLs before authenticating

Patch Information

Consult PrimeKey and Keyfactor release notes for EJBCA Enterprise versions later than 8.0 and apply the vendor-provided update. Refer to the INCIBE Security Notice on EJBCA Vulnerabilities for advisory linkage. No vendor advisory URL is listed in the NVD record at the time of publication.

Workarounds

Place EJBCA behind a reverse proxy that enforces strict URL normalization and blocks unexpected PATH patterns
Configure the proxy to strip or rewrite Location response headers whose destinations fall outside the EJBCA origin
Enforce browser-side protections such as Referrer-Policy: no-referrer and Content Security Policy directives that constrain navigation targets

bash

# Example nginx snippet to block external redirects from EJBCA responses
location / {
    proxy_pass https://ejbca.internal;
    proxy_hide_header Location;
    add_header Location $upstream_http_location;
    if ($upstream_http_location !~ "^https://ejbca\.example\.com/") {
        return 403;
    }
}