A user who has WRITE authorization to an Access Point (i.e. is allowed to place jobs) can impersonate the 'condor' user to daemons of that Access Point. This can allow the user to issue ADMINISTRATOR-level commands, edit any attribute in any job ClassAd, and potentially enable the impersonation of other user accounts on the AP. The user can also obtain an IDToken identifying them as the 'condor' user, which can be used at any other machines that have the same IDToken signing key(s) as the vulnerable Access Point.

An attacker needs to have WRITE authorization to an Access Point (i.e. the ability to place jobs).

An attacker needs to write custom tools.

This attack allows a user to authenticate as the 'condor' user when communicating with daemons of the Access Point. This includes running administrative commands (hold/remove jobs, submit jobs as other users, turn daemons off, etc). The attacker can also request an IDToken for the 'condor' user, which may be usable on other machines if the same IDToken signing keys are present on those machines.

Upgrading your HTCondor Access Points to version 24.0.22, 24.12.22, 25.0.12 or 25.11.1 fully addresses this vulnerability.

If upgrading isn't possible, you can mitigate this issue by removing FS and FS_REMOTE from the set of authentication methods that the schedd and shadow daemons will use in a client role. In a standard setup, you can add these lines to the configuration file(s) on your Access Point(s) and then issue a condor_reconfig:

SCHEDD.SEC_CLIENT_AUTHENTICATION_METHODS = IDTOKENS,KERBEROS,SCITOKENS,SSL,ANONYMOUS

SHADOW.SEC_CLIENT_AUTHENTICATION_METHODS = IDTOKENS,KERBEROS,SCITOKENS,SSL,ANONYMOUS

Embargoed until future notice.