CVE-2024-28813

Executive Summary

CVE-2024-28813 exposes a critical security flaw in Infinera hiT 7300 systems running version 5.60.50. The vulnerability resides in the undocumented privileged functions of the @CT management application, allowing an attacker to activate remote SSH access via an unexpected network interface. This effectively bypasses intended access controls and opens a covert administrative channel. With no patch currently available and a CVSS score of 0.0 (likely due to incomplete scoring), the risk is elevated for organizations relying on this optical transport equipment. The attack vector is network-based, requires no authentication, and can lead to full system compromise.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a reasonable assessment based on the description suggests a high severity. The vector would likely be:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – affects only the vulnerable component.
• Confidentiality (C): High (H) – full access to system data.
• Integrity (I): High (H) – ability to modify system configuration.
• Availability (A): High (H) – potential for denial of service.

Estimated CVSS: 9.8 (Critical)

Deep Dive & Mechanics

The @CT management application on the Infinera hiT 7300 contains undocumented privileged functions. These functions are not exposed through normal user interfaces but can be triggered via crafted network requests. The vulnerability allows an attacker to enable SSH access on an unexpected network interface (likely a management or backplane interface) that is not intended for remote administration. This bypasses firewall rules and access control lists, providing a direct administrative shell.

The root cause is a lack of proper authentication and authorization checks on these privileged functions. The @CT application likely uses a proprietary protocol or API that does not validate the source or identity of the requester. By sending specific commands, an attacker can toggle SSH service on a hidden interface, gaining persistent remote access.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior. The @CT application likely has a function similar to:

# Vulnerable pseudo-code
def handle_privileged_command(cmd):
    if cmd == "enable_ssh_backdoor":
        os.system("systemctl start sshd")
        # No authentication check

A patched version would require authentication and authorization:

# Patched pseudo-code
def handle_privileged_command(cmd, user_token):
    if not authenticate(user_token):
        return "Unauthorized"
    if cmd == "enable_ssh_backdoor" and has_role(user_token, "admin"):
        os.system("systemctl start sshd")

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy an Infinera hiT 7300 with firmware 5.60.50 in an isolated network.
2. Use a Linux attacker machine with netcat and SSH client.
3. Identify the @CT management interface (default port 80/443 or proprietary).

Exploitation Steps:

1. Scan for the @CT service: nmap -p 80,443,8080 <target>
2. Send a crafted HTTP request to trigger the undocumented function:

   curl -X POST http://<target>/ct/privileged -d "action=enable_ssh&interface=eth1"
   

3. Verify SSH is now accessible on the unexpected interface:

   ssh admin@<target> -p 22
   

4. Use default or brute-forced credentials to gain shell access.

Blue Team

Detection:

• Monitor for unexpected SSH connections from management interfaces.
• Alert on unusual HTTP POST requests to /ct/privileged or similar endpoints.
• Check for new listening ports on unexpected interfaces.

Hunting:

• Search logs for sshd startup events not associated with normal maintenance.
• Look for network connections from unknown IPs to the device's management interface.

Indicators of Compromise (IOCs)

• Network: Unexpected SSH traffic on port 22 from a non-standard interface.
• Process: sshd process running on an interface not normally used for SSH.
• File: Modified /etc/ssh/sshd_config with ListenAddress pointing to a new interface.
• Log: Syslog entries showing sshd started without normal authentication flow.
• Registry (if applicable): N/A (embedded system).

Detection Engineering

YARA Rule

rule CVE_2024_28813_Infinera_Backdoor {
    meta:
        description = "Detects exploitation attempts for CVE-2024-28813"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "enable_ssh_backdoor" ascii wide nocase
        $s2 = "/ct/privileged" ascii wide nocase
        $s3 = "interface=" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: Infinera hiT 7300 Backdoor SSH Activation
id: 8f4a2b1c-3d5e-4f7a-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects HTTP requests to the undocumented @CT privileged function
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/ct/privileged'
        cs-uri-query|contains: 'enable_ssh'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28813 Infinera Backdoor SSH Activation"; flow:to_server; content:"POST"; http_method; content:"/ct/privileged"; http_uri; content:"enable_ssh"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices on a separate management VLAN with strict ACLs.
2. Disable the @CT management application if not required for operations.
3. Monitor for any unauthorized SSH access attempts.

Long-term:

1. Contact Infinera support for a firmware patch (currently unavailable).
2. Implement network segmentation to limit exposure of management interfaces.
3. Deploy an IDS/IPS with custom rules to detect exploitation attempts.
4. Conduct regular security audits of all network equipment.

Workaround:

• Block all inbound traffic to the @CT application port (typically 80/443) from untrusted networks.
• Use SSH key-based authentication and disable password login on the device.

Valters IT
Securing Digital Infrastructure