HTCONDOR-2020-0003

A user with read-only authorization to access the job queue is able to perform write operations under their identity, including submitting new jobs. If CLAIMTOBE is part of the READ authentication methods, then the user is able to impersonate any other user when modifying the job queue. This includes submitting and running jobs as any other user. By default, CLAIMTOBE is included in the list of methods for READ access. CVE-2019-18823

This vulnerability allows a user to submit a job as long as they can authenticate using one of the methods in the SEC_READ_AUTHENTICATION_LIST of the SchedD and are authorized by the ALLOW_READ setting. Note that they must still authenticate. However, the user can perform write operations even if the ALLOW_WRITE authorization setting would normally disallow them. Also, if the list of SEC_WRITE_AUTHENTICATION_METHODS is more restrictive in types of methods used, the user can circumvent the stronger security by using a perhaps weaker method from the READ list. If the READ list also contains CLAIMTOBE, the attacker can now submit a job as any user. In a default installation, CLAIMTOBE is part of the list of methods allowed for READ operations.

medium

A thorough understanding of the HTCondor code and the ability to write custom tools is required to exploit this vulnerability.

high

The configuration that is most vulnerable includes the CLAIMTOBE option as part of the SEC_READ_AUTHENTICATION_METHODS. This is the default. If you have set your own value for SEC_READ_AUTHENTICATION_METHODS, and it does not include CLAIMTOBE, then you are not vulnerable.

Ideally, update your installation and you will not need to change any configuration.

Alternatively, you can change your configuration to not use CLAIMTOBE in your authentication methods. Explicitly exclude CLAIMTOBE by setting SEC_READ_AUTHENTICATION_METHODS if you haven't already. The full list of methods by default should be (on Linux) "FS,TOKEN,KERBEROS,GSI,SSL" or (on Windows) "NTSSPI,TOKEN,SSL". In the 8.8.X series you should exclude "TOKEN". You may wish to also exclude other methods you know you are not using.