HTCSS security vulnerability

[Tim Theisen]

Hello,

We have discovered and fixed a security vulnerability in the HTCondor
Software Suite (HTCSS).

The vulnerability allows a user with WRITE authorization to the Access
Point (e.g. allowed to submit jobs) to authenticate as the condor user
to daemons running on the Access Point host. This can allow the user to
issue ADMINISTRATOR-level commands, edit any attribute in any job
ClassAd, and potentially enable the impersonation of other user accounts
on the AP.
The user can also obtain an IDToken identifying them as the condor user,
which can be used at any other machines that have the same IDToken
signing key(s) as the vulnerable Access Point.

Upgrading the Access Points to one of the new releases fully protects
you from this vulnerability. If you can’t upgrade your Access Points,
then you can mitigate the vulnerability by removing FS and FS_REMOTE
from the set of authentication methods that the schedd and shadow
daemons will use in a client role. In a standard setup, you can add
these lines to the configuration file(s) on your Access Point(s) and
then issue a condor_reconfig:

SCHEDD.SEC_CLIENT_AUTHENTICATION_METHODS =
IDTOKENS,KERBEROS,SCITOKENS,SSL,ANONYMOUS
SHADOW.SEC_CLIENT_AUTHENTICATION_METHODS =
IDTOKENS,KERBEROS,SCITOKENS,SSL,ANONYMOUS

The security release versions are 24.0.22, 24.12.22, 25.0.12, and 25.11.1.

Please let us know if you have any questions.