CVE-2024-21653

Executive Summary

CVE-2024-21653 is a medium-severity vulnerability in the vantage6 platform, a technology for managing and deploying privacy-enhancing technologies such as Federated Learning (FL) and Multi-Party Computation (MPC). The vulnerability stems from a default SSH configuration that permits root login with password authentication. While in a proper deployment the SSH service is not exposed, the default configuration is overly permissive and could be exploited if the SSH port is inadvertently exposed. The vulnerability is mitigated by removing the SSH part from the Dockerfile and rebuilding the Docker image, or by upgrading to version 4.2.0. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild, but the risk increases in misconfigured deployments.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Docker-based deployment of the vantage6 platform. The insecure default SSH configuration is embedded in the Docker image, which is a supply chain concern for organizations using vantage6 containers. Users should verify the integrity of their Docker images and ensure they are built from trusted sources.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is considered medium due to the low complexity of exploitation if the SSH service is exposed. However, the default configuration is not intended to expose SSH, so the actual risk depends on deployment practices.

Deep Dive & Mechanics

The vulnerability is rooted in the default SSH configuration provided in the vantage6 Docker image. The SSH daemon is configured to allow root login with password authentication. In a standard deployment, the SSH port (22) is not exposed to the network, but if an administrator inadvertently exposes it (e.g., via Docker port mapping or misconfigured firewall), an attacker could attempt to brute-force the root password. The default configuration does not enforce key-based authentication or disable password authentication, making it susceptible to credential guessing attacks.

The vulnerable component is the SSH configuration file within the Docker image. The fix involves either removing the SSH service entirely from the Dockerfile or hardening the SSH configuration to disable root login and password authentication.

Vulnerable vs. Patched Code

Vulnerable Configuration (Dockerfile snippet):

FROM ubuntu:20.04
RUN apt-get update && apt-get install -y openssh-server
RUN echo 'root:password' | chpasswd
RUN sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
RUN sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/' /etc/ssh/sshd_config
CMD ["/usr/sbin/sshd", "-D"]

Patched Configuration (Dockerfile snippet):

FROM ubuntu:20.04
# SSH service removed entirely
# No SSH installation or configuration
CMD ["your_application_command"]

Alternatively, if SSH is required, the patched configuration would disable root login and password authentication:

FROM ubuntu:20.04
RUN apt-get update && apt-get install -y openssh-server
RUN sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
RUN sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
RUN sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/' /etc/ssh/sshd_config
CMD ["/usr/sbin/sshd", "-D"]

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vantage6 node or server with SSH port exposed (e.g., port 22 mapped to host).
• Knowledge of the target IP address.

Exploitation Steps:

1. Scan the target for open SSH port:

   nmap -p 22 <target_ip>
   

2. Attempt to brute-force the root password using a tool like Hydra:

   hydra -l root -P /path/to/password_list.txt ssh://<target_ip>
   

3. If successful, gain root access to the container.

Note: No public exploit code is available for this CVE.

Blue Team

Detection and Prevention:

• Ensure SSH port is not exposed in Docker configurations.
• Use network segmentation to isolate vantage6 containers.
• Implement host-based firewalls to block inbound SSH connections.
• Monitor for failed SSH login attempts.
• Use SSH key-based authentication if SSH is required.

Indicators of Compromise (IOCs)

• Network: Unauthorized SSH connections to port 22 on vantage6 nodes/servers.
• Logs: Multiple failed SSH login attempts for root user in /var/log/auth.log or /var/log/secure.
• Process: Unusual SSH daemon processes running in containers.
• File: Presence of /etc/ssh/sshd_config with PermitRootLogin yes and PasswordAuthentication yes.

Detection Engineering

YARA Rule

rule CVE_2024_21653_SSH_Config
{
    meta:
        description = "Detects vulnerable SSH configuration in vantage6 Docker images"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-21653"
    strings:
        $s1 = "PermitRootLogin yes" ascii wide nocase
        $s2 = "PasswordAuthentication yes" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-21653 - SSH Root Login with Password Authentication
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSH configuration allowing root login with password authentication
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21653
author: Valters IT
date: 2024/01/01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/sshd'
        CommandLine|contains|all:
            - 'PermitRootLogin yes'
            - 'PasswordAuthentication yes'
    condition: selection
falsepositives:
    - Legitimate administrative configurations
level: medium

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2024-21653 - SSH Brute Force Attempt"; flow:to_server,established; content:"SSH-"; depth:4; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to vantage6 version 4.2.0 or later.
2. If upgrade is not possible, rebuild the Docker image without the SSH component.
3. Ensure SSH port is not exposed in Docker run commands or docker-compose files.

Long-term Mitigations:

• Implement network segmentation to isolate vantage6 containers.
• Use SSH key-based authentication if SSH is required.
• Regularly audit Docker configurations for insecure defaults.
• Monitor for unauthorized SSH access attempts.

Patch Details:

• Upgrade to version 4.2.0, which removes the SSH component from the default Docker image.
• Alternatively, modify the Dockerfile to remove SSH installation and rebuild the image.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert