Executive brief
Keyfactor SignServer is a PKI/code-signing solution used by enterprises to manage digital certificates and cryptographic operations. An administrative user can misconfigure three file path properties (ATTRIBUTESFILE, KEYSTOREPATH, TRUSTSTOREPATH) to probe the server's filesystem and determine whether specific files exist, potentially exposing sensitive information about the system configuration and file structure to clients.
Technical details
The vulnerability is a local file enumeration flaw affecting three properties in SignServer's cryptographic token implementations: ATTRIBUTESFILE in PKCS11CryptoToken, KEYSTOREPATH in KeyStoreCryptoToken, and TRUSTSTOREPATH in RenewalWorker. The root cause is insufficient input validation on file path properties, allowing an authenticated admin to set these paths without restrictions. When a misconfigured path is used, the application returns error messages that confirm file existence or non-existence, enabling an attacker with admin privileges to enumerate the filesystem. This requires administrative access to the application and does not directly compromise cryptographic keys or sign operations. The vulnerability was patched in SignServer 7.6.0.
Affected products
- Keyfactor SignServer before 7.6.0
Timeline
- 2026-09-15: disclosed
- 2026: patched: Fixed in SignServer 7.6.0