search

Keyfactor / ejbca-vault-pki-engine

EJBCA PKI Engine and Backend for HashiCorp Vault. Used to issue, sign, and revoke certificates using the EJBCA CA.
Apache License 2.0
5 stars 2 forks source link

ejbca-pki/revoke endpoint ignores private key #8

Closed verdantvestibule closed 3 months ago

verdantvestibule commented 4 months ago

The revoke endpoint for EJBCA will merrily revoke any cert for which you have the Serial Number. Vault 'PKI', on the other hand, requires the private key to be presented to revoke.

We consider this desired functionality: without accepting and validating the private key it would allow anyone with access to the endpoint and knowledge of a cert's serial number to revoke that cert. This is a problem as we expose multiple roles to generate certs and expect that we can only revoke for certificates in our possession.

m8rmclaren commented 4 months ago

Hi @verdantvestibule!

Thank you for submitting this issue and bringing this vulnerability to our attention. This will be addressed in Version 1.2 in this PR.