CVE-2021-25311: 
NixOS vulnerability analysis and mitigation

condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory, as demonstrated by creating a file under /etc that will later be executed by root. The vulnerability was discovered and disclosed on January 27, 2021, affecting HTCondor versions 8.9.7 through 8.9.10 on all platforms (HTCondor Security).

The vulnerability has a CVSS v3.1 Base Score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The issue allows an authenticated user to convince the CredD to create or overwrite a file owned as root with attacker-specified contents. While the exact filename cannot be completely specified by the attacker, files can be created in various locations such as /etc where they may be executed with root privileges (SANS Risk).

The vulnerability has high impact potential as it allows an attacker to create files anywhere on the filesystem with root privileges. The contents of these files can be controlled by the attacker, and while the complete filename cannot be specified, files can be placed in sensitive locations like /etc where they may be executed with root privileges. This could lead to complete system compromise (HTCondor Security).

The vulnerability requires only low effort to exploit. Any user who can authenticate to the condor_credd process can exploit this vulnerability, which by default includes any user who can login to the CredD machine. The authentication can use default methods such as 'FS' on Linux or 'NTSSPI' on Windows. Command line tools supplied with HTCondor can be used to execute the exploit (HTCondor Security).

The vulnerability was fixed in HTCondor version 8.9.11. For systems unable to upgrade immediately, the primary workaround is to disable the condor_credd if it is not required. Note that CREDD is automatically added to the DAEMON_LIST if 'use feature:OAUTH' is enabled, so systems should verify their configuration (HTCondor Security).