CVE-2021-21296 - Vulnerability Details - OpenCVE

ReportizFlow

Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:S/C:N/I:N/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fleetdm	Fleet

Configuration 1 [-]

cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:node.js:*:*

No data.

References

Link	Providers
https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40
https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45
https://www.npmjs.com/package/fleetctl

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-02-10T20:00:19

Updated: 2024-08-03T18:09:15.667Z

Reserved: 2020-12-22T00:00:00

Link: CVE-2021-21296

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-02-10T20:15:15.353

Modified: 2024-11-21T05:47:57.893

Link: CVE-2021-21296

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "fleet", "vendor": "fleetdm", "versions": [{"status": "affected", "version": "< 3.7.0"}]}], "descriptions": [{"lang": "en", "value": "Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-02-10T20:00:19", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"tags": ["x_refsource_MISC"], "url": "https://www.npmjs.com/package/fleetctl"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}], "source": {"advisory": "GHSA-xwh8-9p3f-3x45", "discovery": "UNKNOWN"}, "title": "Denial-of-service in Fleet", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2021-21296", "STATE": "PUBLIC", "TITLE": "Denial-of-service in Fleet"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "fleet", "version": {"version_data": [{"version_value": "< 3.7.0"}]}}]}, "vendor_name": "fleetdm"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-400 Uncontrolled Resource Consumption"}]}]}, "references": {"reference_data": [{"name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45", "refsource": "CONFIRM", "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"name": "https://www.npmjs.com/package/fleetctl", "refsource": "MISC", "url": "https://www.npmjs.com/package/fleetctl"}, {"name": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40", "refsource": "MISC", "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}]}, "source": {"advisory": "GHSA-xwh8-9p3f-3x45", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:09:15.667Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.npmjs.com/package/fleetctl"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-21296", "datePublished": "2021-02-10T20:00:19", "dateReserved": "2020-12-22T00:00:00", "dateUpdated": "2024-08-03T18:09:15.667Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "36E3F4B9-FBF0-4F41-A8A0-20F7BB120A9A", "versionEndExcluding": "3.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0."}, {"lang": "es", "value": "Fleet es un administrador osquery de c\u00f3digo abierto. En Fleet versiones anteriores a 3.7.0, un actor malicioso con una clave de nodo v\u00e1lida puede enviar una petici\u00f3n mal formateada que hace que el servidor Fleet salga, lo que resulta en la denegaci\u00f3n del servicio. Esto solo es posible mientras se presenta una consulta en vivo en curso. Creemos que el impacto de esta vulnerabilidad es bajo el requerimiento dado de que el actor tenga una clave de nodo v\u00e1lida. No existe una divulgaci\u00f3n de informaci\u00f3n, escalada de privilegios ni ejecuci\u00f3n de c\u00f3digo. El problema es corregido en Fleet versi\u00f3n 3.7.0"}], "id": "CVE-2021-21296", "lastModified": "2024-11-21T05:47:57.893", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "[email protected]", "type": "Primary"}]}, "published": "2021-02-10T20:15:15.353", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"source": "[email protected]", "tags": ["Product", "Third Party Advisory"], "url": "https://www.npmjs.com/package/fleetctl"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://www.npmjs.com/package/fleetctl"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "[email protected]", "type": "Primary"}]}