Claroty Product Security Advisory: Claroty Secure Remote Access Authentication Bypass

This advisory provides important information regarding a security vulnerability affecting Claroty Secure Access (formerly Claroty Secure Remote Access  or SRA) versions 3.0-3.2. An Authentication Bypass Using an Alternate Path or Channel was discovered that could allow an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid session tokens for the web user interface (UI). With access to the web UI an attacker can access assets managed by the SRA installation and could compromise the installation. 

Successful exploitation of this vulnerability enables an attacker with local (Linux) system access to bypass access controls for the central configuration file of the SRA Site software.

Remediation

Users should upgrade their SRA installation to Version 3.2.1 (released April 27, 2021). Users unable to apply the latest patch should restrict non-admin access to the system hosting the SRA Site software as an interim mitigation.

Users may contact either Claroty Support or a Customer Success Manager to obtain the latest release of SRA, which includes the fix to this vulnerability.

Acknowledgements 

Claroty would like to thank AlphaStrike Labs for reporting this issue, the related research effort, and the close collaboration during the coordinated disclosure.