CVE-2024-28810

Executive Summary

CVE-2024-28810 exposes a critical information disclosure vulnerability in Infinera hiT 7300 optical transport equipment running version 5.60.50. The flaw resides in the diagnostic file export functionality of the @CT application, which inadvertently includes sensitive information such as credentials, configuration secrets, or network topology data. An attacker with local or network access to these exported files can achieve a complete loss of confidentiality, potentially leading to further network compromise. No public exploit code or patch is currently available, making this a high-priority monitoring and hardening issue for operators of this equipment.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Threat Level: High (based on impact and lack of patch)
• Attack Vector: Local or Network (depending on how diagnostic files are accessed)
• Attack Complexity: Low
• Privileges Required: Low (attacker needs access to exported files)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability originates from the @CT application's diagnostic data export routine. When generating diagnostic bundles (e.g., for troubleshooting), the application includes configuration files, logs, and system state dumps without proper sanitization. These files may contain:

• Plaintext credentials (SNMP community strings, RADIUS/TACACS+ keys, local user passwords)
• Network topology information (IP addresses, VLAN configurations, routing tables)
• Cryptographic material (SSH keys, certificates)
• Session tokens or API keys

An attacker who gains access to these diagnostic files—either through a compromised management interface, physical access, or by intercepting file transfers—can extract this sensitive data. The lack of encryption or access controls on the exported files exacerbates the risk.

Vulnerable vs. Patched Code

Vulnerable (5.60.50): The @CT application exports diagnostic data without filtering sensitive fields. For example, a configuration dump might include:

snmp-server community public RO
snmp-server community private RW
username admin password 7 0822455D0A16

Patched (Hypothetical): A patched version would sanitize the export by:

• Masking or removing credential fields
• Redacting IP addresses and hostnames
• Encrypting the diagnostic bundle
• Implementing role-based access control for export operations

No official patch is available as of this report.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify Infinera hiT 7300 devices via Shodan or network scanning (e.g., nmap -p 22,80,443,161,162 --open <target>).
2. Access Diagnostic Files: If the management interface is exposed, attempt to download diagnostic bundles via HTTP/HTTPS or FTP. Default credentials may be used.
3. Extract Secrets: Use strings or grep to find credentials in the downloaded files:

   strings diagnostic_bundle.tar.gz | grep -E "(password|secret|community|key)"
   

4. Lateral Movement: Use extracted credentials to access other network devices or management systems.

Blue Team

1. Network Segmentation: Isolate management interfaces of hiT 7300 devices from general network traffic.
2. Access Control: Restrict access to diagnostic export functionality to authorized administrators only.
3. Monitoring: Alert on any download of diagnostic files from the @CT application.
4. Encryption: Ensure all diagnostic files are encrypted at rest and in transit.
5. Credential Rotation: Immediately rotate all credentials that may have been exposed.

Indicators of Compromise (IOCs)

• File Hashes (MD5): d41d8cd98f00b204e9800998ecf8427e (example – replace with actual)
• Network Patterns: Unusual outbound connections from hiT 7300 to unknown IPs on ports 21, 22, 80, 443
• Log Entries: Multiple failed login attempts followed by successful login from a new IP
• File Artifacts: Presence of diagnostic bundle files (e.g., diagnostic_*.tar.gz) in unexpected locations
• Process Anomalies: Unauthorized processes reading /var/log/ or configuration directories

Detection Engineering

YARA Rule

rule CVE_2024_28810_Infinera_InfoDisclosure {
    meta:
        description = "Detects diagnostic files containing sensitive Infinera hiT 7300 data"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-28810"
    strings:
        $s1 = "snmp-server community" ascii wide nocase
        $s2 = "username" ascii wide nocase
        $s3 = "password 7" ascii wide nocase
        $s4 = "enable secret" ascii wide nocase
        $s5 = "tacacs-server key" ascii wide nocase
        $s6 = "radius-server key" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: Infinera hiT 7300 Diagnostic File Download
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects download of diagnostic files from Infinera hiT 7300 devices
author: Valters IT
date: 2024-10-27
logsource:
    category: web
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - '/diagnostic'
            - '/export'
            - '/bundle'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate administrative downloads
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-28810 Infinera hiT 7300 Diagnostic File Exfiltration";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/diagnostic"; http_uri;
    content:"200"; http_server_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-28810;
)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to the @CT application to trusted IPs only.
   • Disable diagnostic file export if not required.
   • Rotate all credentials that may have been exposed.
   • Monitor for unauthorized access to diagnostic files.

2. Long-term Fixes:

   • Apply vendor patch when available.
   • Implement network segmentation for management interfaces.
   • Use encryption for all diagnostic data in transit and at rest.
   • Conduct regular security audits of configuration exports.

3. Workarounds:

   • Manually sanitize diagnostic files before sharing.
   • Use a dedicated jump host for accessing management interfaces.

Valters IT
DevSecOps & Cyber Threat Intelligence