#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product:  VeridiumAD - 2.5.3.0 [1]
# Vendor:   VeridiumID [2]
# CSNC ID:  CSNC-2021-017
# CVE ID:   CVE-2021-42791
# Subject:  Broken Access Control
# Risk:     Medium
# Effect:   Remotely exploitable
# Author:   Philipp Mao <philipp.mao@compass-security.com>
# Date:     25.1.2022
#
#############################################################

Introduction:
-------------
VeridiumAD allows users to login to their Windows workstations without entering a password using only the second factor.
VeridiumAD 2.5.3 does not enforce proper access control in the HTTP request to trigger a login push notification. 

Affected:
---------
VeridiumAD = 2.5.3 (lower versions may also be affected)
 
Technical Description
---------------------
The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user.
The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user's Kerberos TGT.

Workaround / Fix:
-----------------
Update to VeridiumAD version 2.5.7

Timeline:
---------
2021-10-01:     Discovery by Philipp Mao
2021-10-01:     Initial vendor notification/response 
2021-12-01:		Release of fixed version	 	
2022-01-25: 	Publication   

References:
-----------
[1] https://www.veridiumid.com/workforce-authentication/
[2] https://www.veridiumid.com/