CVE-2024-28807

Executive Summary

CVE-2024-28807 exposes a critical cleartext credential storage vulnerability in the Infinera hiT 7300 platform (version 5.60.50). The flaw resides in the @CT desktop management application, where sensitive user passwords are stored in plaintext within the application’s memory. A guest OS administrator with local access can dump the memory of the @CT process and extract all stored credentials, leading to a complete compromise of the management plane. This vulnerability is particularly dangerous in multi-tenant or shared hosting environments where guest OS administrators are not fully trusted. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward for any attacker with local administrative privileges on the host.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the host.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires guest OS admin privileges.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – The compromised credentials can be used to access other systems (e.g., network devices, databases).
• Confidentiality (C): High (H) – All stored passwords are exposed.
• Integrity (I): None (N) – No direct integrity impact.
• Availability (A): None (N) – No direct availability impact.
• Base Score: 5.5 (Medium)

Threat Level: Medium. While the CVSS score is moderate, the real-world impact is high because it allows lateral movement and privilege escalation within the Infinera ecosystem.

Deep Dive & Mechanics

The @CT desktop management application is used to configure and monitor Infinera hiT 7300 optical transport equipment. During normal operation, the application stores user credentials (e.g., for SNMP, CLI, web interfaces) in memory to facilitate automated tasks. The vulnerability arises because these credentials are stored in cleartext without any encryption or obfuscation.

Attack Flow:

1. Attacker gains guest OS administrator privileges on the host running @CT.
2. Attacker uses a memory dump tool (e.g., procdump, gcore, or Windows Task Manager) to capture the memory of the @CT process.
3. Attacker analyzes the dump using a hex editor or strings utility to locate plaintext passwords.
4. Extracted passwords are then used to access other Infinera devices or management interfaces.

Root Cause: The application uses standard string objects (e.g., std::string in C++ or String in Java) to store credentials without invoking any secure memory wiping or encryption API.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

// Vulnerable: stores password in plaintext std::string
std::string password = "admin123";
// ... use password ...
// No secure wipe after use

Patched Code (Hypothetical):

#include <windows.h>
#include <string>

void SecureString(std::string &str) {
    if (!str.empty()) {
        SecureZeroMemory(&str[0], str.size());
    }
}

// Patched: use secure memory and wipe after use
std::string password = GetPasswordFromUser();
// ... use password ...
SecureString(password);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local admin access on the Windows/Linux host running @CT.
• Infinera hiT 7300 with @CT version 5.60.50.

Steps:

1. Identify the @CT process (e.g., @CT.exe or @CT).
2. Dump the process memory:
   • Windows: procdump -ma @CT.exe dump.dmp
   • Linux: gcore <PID>
3. Extract passwords:

   strings dump.dmp | grep -E '(password|passwd|secret|credential)' -i
   

4. Use extracted credentials to access other Infinera devices.

Blue Team

Detection:

• Monitor for memory dump tools (procdump, gcore, taskmgr) being executed by non-administrative users.
• Alert on unusual access to the @CT process memory (e.g., via API calls like OpenProcess with PROCESS_VM_READ).

Prevention:

• Restrict local admin privileges to only trusted personnel.
• Use application whitelisting to block memory dump tools.
• Implement Credential Guard (Windows) or similar technologies to isolate credentials.

Indicators of Compromise (IOCs)

• Process: @CT.exe or @CT with memory dump artifacts.
• File: Memory dump files (.dmp, .core, .dump) in user directories.
• Network: Unusual authentication attempts from the host to other Infinera devices using extracted credentials.
• Registry (Windows): HKLM\SOFTWARE\Infinera\@CT containing cleartext credentials (if stored persistently).

Detection Engineering

YARA Rule

rule CVE_2024_28807_Cleartext_Credentials {
    meta:
        description = "Detects cleartext passwords in Infinera @CT memory dumps"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28807"
    strings:
        $password = /password[=:]\s*[^\s]{4,}/ nocase
        $credential = /credential[=:]\s*[^\s]{4,}/ nocase
        $secret = /secret[=:]\s*[^\s]{4,}/ nocase
    condition:
        any of them
}

Sigma Rule

title: Infinera @CT Memory Dump Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects memory dump tools targeting the @CT process
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\procdump.exe'
            - '\gcore.exe'
            - '\taskmgr.exe'
        CommandLine|contains: '@CT'
    condition: selection
falsepositives:
    - Legitimate administrative use
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28807 - Infinera @CT Credential Exfiltration"; flow:to_server,established; content:"password"; nocase; content:"admin"; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict local admin access to the @CT host to only essential personnel.
2. Enable Credential Guard (Windows) or use mlock()/VirtualLock to prevent memory paging.
3. Monitor for memory dump tools and alert on their execution.

Long-term Fix:

• Infinera must release a patch that encrypts credentials in memory using Windows DPAPI or Linux keyrings.
• Implement secure memory wiping after credential use.
• Consider using a credential vault (e.g., HashiCorp Vault) instead of storing passwords in the application.

Workaround:

• Use a dedicated, isolated VM for @CT with strict access controls.
• Rotate all passwords stored in @CT immediately.

Valters IT