CVE-2024-25661

Executive Summary

CVE-2024-25661 exposes a critical security flaw in Infinera TNMS (Transcend Network Management System) version 19.10.3. The vulnerability allows a guest OS administrator to retrieve cleartext passwords of various users by reading memory dumps of the TNMS Client desktop application. This is a classic case of CWE-312: Cleartext Storage of Sensitive Information, where sensitive data (passwords) is stored in memory without encryption or obfuscation. The attack requires local access to the host system, but once achieved, it can lead to lateral movement and privilege escalation within the network management infrastructure.

Supply Chain & Package Security

This vulnerability is not related to open-source packages (NPM, PyPI, Go, Ruby). It is a proprietary desktop application (TNMS Client) used for managing Infinera optical transport networks. The risk is primarily to organizations that have deployed Infinera TNMS in their network operations centers (NOCs).

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Local – requires physical or remote desktop access to the host.
• Attack Complexity (AC): Low – memory dumps are easily obtainable with standard OS tools.
• Privileges Required (PR): High – attacker must already have guest OS admin privileges.
• User Interaction (UI): None – no user action needed beyond normal application use.
• Scope (S): Unchanged – exploitation does not affect other components.
• Confidentiality (C): High – cleartext passwords are exposed.
• Integrity (I): None – no data modification.
• Availability (A): None – no denial of service.

Threat Level: High (Confidentiality impact is severe, but requires local admin access).

Deep Dive & Mechanics

The TNMS Client desktop application stores user credentials in cleartext within its process memory. When a user logs in, the password is held in a string variable that is not encrypted or masked. A guest OS administrator can use tools like procdump (Windows) or gcore (Linux) to capture a memory dump of the TNMS Client process. Then, using a simple string search (e.g., strings memory.dmp | grep -i password), the attacker can extract the cleartext passwords.

Key technical details:

• The vulnerability is in the client-side application, not the server.
• The passwords are stored in memory during the session and may persist even after logout if the process is not properly cleaned.
• The attack does not require network access; it is purely local.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior:

Vulnerable Code (Conceptual):

// TNMS Client login handler
string username = txtUsername.Text;
string password = txtPassword.Text; // Stored in cleartext in memory
// Send to server
SendLoginRequest(username, password);

Patched Code (Expected):

// TNMS Client login handler
string username = txtUsername.Text;
SecureString password = new SecureString();
foreach (char c in txtPassword.Text.ToCharArray())
{
    password.AppendChar(c);
}
// Use SecureString for transmission
SendLoginRequest(username, password);

The patch should use SecureString (or equivalent) to store the password in encrypted memory and zero it out after use.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local admin access to a Windows or Linux host running TNMS Client 19.10.3.
• TNMS Client process must be running (user logged in).

Steps:

1. Identify the TNMS Client process ID (PID):

   # Windows
   tasklist | findstr TNMS
   # Linux
   ps aux | grep TNMS
   

2. Capture a memory dump:

   # Windows (using Sysinternals procdump)
   procdump -ma <PID> tnms.dmp
   # Linux
   gcore <PID>
   

3. Extract cleartext passwords:

   strings tnms.dmp | grep -E "(password|passwd|pwd)" --ignore-case
   

4. Use extracted passwords for lateral movement (e.g., SSH to network devices, web consoles).

Blue Team (Defense & Detection)

Mitigation Steps:

• Restrict local admin access to TNMS Client hosts.
• Use application whitelisting to prevent unauthorized tools (e.g., procdump).
• Enable Windows Defender Credential Guard or Linux memlock to protect process memory.
• Monitor for memory dump tools execution (see Detection Engineering).

Hunting:

• Look for processes named procdump, gcore, or dump in security logs.
• Check for unusual memory dump files (.dmp, .core) on critical hosts.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_25661_TNMS_Memory_Dump
{
    meta:
        description = "Detects memory dumps containing cleartext passwords from Infinera TNMS Client"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25661"
    strings:
        $s1 = "TNMSClient" ascii wide nocase
        $s2 = "password" ascii wide nocase
        $s3 = "login" ascii wide nocase
    condition:
        $s1 and $s2 and $s3
}

Sigma Rule

title: Detection of Memory Dump Tools on TNMS Hosts
id: 7a8b3c4d-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects execution of memory dump tools (procdump, gcore) on hosts running Infinera TNMS Client
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\procdump.exe'
            - '\procdump64.exe'
        CommandLine|contains: 'TNMS'
    condition: selection
falsepositives:
    - Legitimate debugging by administrators
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-25661 - TNMS Client Memory Dump Exfiltration"; flow:to_server; content:"TNMS"; nocase; content:".dmp"; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict local admin access to TNMS Client hosts.
2. Enable memory protection (e.g., Windows Defender Credential Guard, Linux mprotect).
3. Monitor for memory dump tools using the Sigma rule above.
4. Change all passwords that may have been exposed.

Long-term Fix:

• Infinera must release a patch that uses SecureString or equivalent to store passwords in encrypted memory.
• Implement proper memory cleanup after authentication (zero out buffers).

Workaround:

• Use a dedicated, isolated VM for TNMS Client with no other admin access.
• Disable memory dump creation via Group Policy (Windows: Computer Configuration > Administrative Templates > System > Allow crash dump creation).

Valters IT