CVE-2014-3621

What it actually does

Allows remote authenticated users to read sensitive configuration options via crafted endpoints that trigger catalog URL replacement with values such as $(admin_token) in the publicurl field.

Why it matters to the business

Exposure of secrets like admin tokens can enable further unauthorized access, increasing risk of data breaches and operational disruption in affected deployments.

How an attack unfolds

An authenticated user creates or modifies an endpoint containing a replacement string in a URL field; the system substitutes the sensitive value during catalog processing, returning it to the attacker.

How to fix it

Upgrade to fixed package versions such as 1:4.2.6.3-0ubuntu1.

How to confirm the fix worked

Confirm installed versions match or exceed the listed fixed releases and test that crafted endpoint URLs no longer cause sensitive values to be substituted or returned.

Typical attack path

1. Authenticate to the identity service
2. Create or update an endpoint with a crafted URL containing a variable replacement
3. Trigger catalog URL replacement
4. Observe and capture the leaked sensitive configuration value

How to detect it

Search authentication and catalog logs for endpoint creation or update events containing variable substitution patterns in URL fields, and review access to configuration retrieval operations by non-privileged accounts.

What your security team should do

• Apply updates to reach the fixed package versions
• Restrict permissions for creating or modifying endpoints to least privilege
• Audit existing endpoint configurations for suspicious URL patterns