CVE-2024-25658

Executive Summary

CVE-2024-25658 exposes a critical security flaw in Infinera TNMS (Transcend Network Management System) Server version 19.10.3. The vulnerability allows attackers with access to the database or exported configuration files to retrieve SNMP users' usernames and passwords in cleartext. This is a classic case of cleartext storage of sensitive information (CWE-312), which violates fundamental security principles and exposes the network infrastructure to unauthorized access and control.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain package (NPM, PyPI, Go, Ruby). It is a proprietary network management system from Infinera. The risk is primarily to organizations that have deployed this specific version of TNMS and have not adequately secured their database or configuration file exports.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. However, based on the nature of the vulnerability, a realistic assessment would be:

• Attack Vector (AV): Local (AV:L) – Requires access to the database or exported config files.
• Attack Complexity (AC): Low (AC:L) – No special conditions.
• Privileges Required (PR): Low (PR:L) – Attacker needs some level of access to the system.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (C:H) – Full disclosure of SNMP credentials.
• Integrity (I): High (I:H) – SNMP credentials can be used to modify network devices.
• Availability (A): High (A:H) – SNMP credentials can be used to disrupt network services.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Score: 7.8 (High)

Threat Level: High. The vulnerability is easy to exploit once an attacker has gained access to the database or configuration files. The impact is severe as it can lead to full compromise of the SNMP-managed network infrastructure.

Deep Dive & Mechanics

The vulnerability lies in how Infinera TNMS stores SNMP user credentials. Instead of using a secure hashing algorithm (e.g., bcrypt, scrypt) or encryption, the system stores the usernames and passwords in cleartext within its database and exported configuration files.

Attack Scenario:

1. Initial Access: An attacker gains access to the TNMS server through another vulnerability (e.g., SQL injection, weak SSH credentials, or physical access).
2. Data Extraction: The attacker queries the database (e.g., SELECT username, password FROM snmp_users) or locates exported configuration files (e.g., config_backup.xml).
3. Credential Harvesting: The attacker extracts cleartext SNMP usernames and passwords.
4. Network Compromise: Using the harvested SNMP credentials (typically read-write community strings or v3 user credentials), the attacker can:
   • Read SNMP data from network devices (routers, switches, firewalls).
   • Modify device configurations.
   • Disable interfaces or change routing tables.
   • Deploy malicious firmware or configurations.

Root Cause: The developers chose to store credentials in cleartext for ease of debugging or legacy compatibility, ignoring standard security practices.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Storing password in cleartext
def store_snmp_user(username, password):
    db.execute("INSERT INTO snmp_users (username, password) VALUES (?, ?)", (username, password))

Patched Code (Conceptual):

# Patched: Hashing the password before storage
import hashlib
import os

def store_snmp_user(username, password):
    salt = os.urandom(16)
    hashed_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt, 100000)
    db.execute("INSERT INTO snmp_users (username, password_hash, salt) VALUES (?, ?, ?)", (username, hashed_password, salt))

Note: Since no official patch is available, the above is a recommended fix. The vendor (Infinera) has not released a security update as of this report.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Extract cleartext SNMP credentials from a vulnerable TNMS server.

Prerequisites:

• Access to the TNMS server (e.g., via SSH, RDP, or a web shell).
• Knowledge of the database location (typically a SQLite or MySQL database).

Steps:

1. Identify the Database:

   find / -name "*.db" -type f 2>/dev/null | grep -i tnms
   

2. Extract Credentials (SQLite example):

   sqlite3 /path/to/tnms.db "SELECT username, password FROM snmp_users;"
   

3. Extract from Configuration Files:

   grep -r "snmp_password" /path/to/config/backups/
   

4. Use Credentials:

   snmpwalk -v3 -u harvested_user -l authPriv -a SHA -A harvested_password -x AES -X harvested_password 192.168.1.1
   

Blue Team (Defensive)

Objective: Detect and prevent exploitation of CVE-2024-25658.

Steps:

1. Inventory: Identify all TNMS servers running version 19.10.3.
2. Isolate: Place TNMS servers on a separate management VLAN with strict firewall rules.
3. Monitor: Enable logging for database access and configuration file reads.
4. Harden: Implement file integrity monitoring (FIM) on the TNMS database and config directories.
5. Credential Rotation: Immediately rotate all SNMP credentials stored in the vulnerable system.
6. Workaround: If patching is not possible, consider using a credential vault or encrypting the database at rest.

Indicators of Compromise (IOCs)

• File Paths:
  • /opt/infinera/tnms/data/tnms.db
  • /var/backups/tnms/config_backup_*.xml
• Database Queries:
  • SELECT * FROM snmp_users
• Network Traffic:
  • Unusual SNMP traffic from the TNMS server to network devices (e.g., snmpwalk commands).
• Log Entries:
  • sqlite3 or mysql commands executed by non-root users.
  • grep commands searching for "password" in config files.

Detection Engineering

YARA Rule

rule CVE_2024_25658_Cleartext_SNMP_Credentials {
    meta:
        description = "Detects cleartext SNMP passwords in Infinera TNMS database or config files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25658"
    strings:
        $s1 = "snmp_users" ascii wide nocase
        $s2 = "password" ascii wide nocase
        $s3 = "username" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10MB
}

Sigma Rule

title: Detection of Cleartext SNMP Credentials in Infinera TNMS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to Infinera TNMS database or config files containing cleartext SNMP passwords
author: Valters IT
date: 2024/01/01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/sqlite3'
            - '/mysql'
            - '/grep'
        CommandLine|contains:
            - 'snmp_users'
            - 'password'
            - 'config_backup'
    condition: selection
falsepositives:
    - Legitimate administrative activity
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-25658 - Potential SNMP Credential Exfiltration"; flow:to_server,established; content:"snmp_users"; nocase; content:"password"; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the TNMS Server: Place it on a restricted management network.
2. Rotate SNMP Credentials: Change all SNMP community strings and user passwords.
3. Monitor for Unauthorized Access: Review logs for database access and config file reads.

Long-Term Fix:

• Vendor Patch: Contact Infinera support for a security update. If unavailable, consider migrating to a different NMS solution.
• Encryption at Rest: Implement full-disk encryption (e.g., LUKS) on the TNMS server.
• Credential Vaulting: Use a secrets management tool (e.g., HashiCorp Vault) to store and retrieve SNMP credentials dynamically.

Workaround:

• Database Encryption: Use SQLite's encryption extension (SEE) or MySQL's TDE to encrypt the database file.
• File Permissions: Restrict access to the database and config directories to only the TNMS service account.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert