CVE-2024-31497

Executive Summary

CVE-2024-31497 is a critical cryptographic vulnerability in PuTTY versions 0.68 through 0.80, affecting the generation of ECDSA nonces for the NIST P-521 curve. The flaw allows an attacker who can observe approximately 60 signatures to recover the victim's private key. This is particularly dangerous in two primary scenarios: (1) when signatures are publicly available (e.g., Git commit signatures made via Pageant agent forwarding), enabling supply-chain attacks; and (2) when a victim authenticates to a malicious SSH server, allowing the server operator to derive the private key and compromise other services. The vulnerability stems from biased nonce generation, where the nonce is not uniformly random, making it predictable enough for key recovery using lattice-based attacks. The impact is severe, as it undermines the security of SSH authentication and code signing, potentially leading to widespread compromise of Git repositories and infrastructure.

Supply Chain & Package Security

This vulnerability directly impacts the software supply chain. If an attacker compromises a developer's SSH key used for Git commit signing, they can inject malicious code into repositories, impersonate the developer, and propagate malware to downstream users. The attack is especially potent because signatures are often stored in public Git services (e.g., GitHub, GitLab), providing a ready source of signed messages. Organizations using PuTTY for SSH agent forwarding in CI/CD pipelines are at high risk.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The attacker can collect signatures remotely.
• Attack Complexity: Low (AC:L) – Requires only observing ~60 signatures.
• Privileges Required: None (PR:N) – No authentication needed to collect signatures.
• User Interaction: None (UI:N) – No victim action required beyond normal use.
• Scope: Unchanged (S:U) – The vulnerability is confined to the affected component.
• Confidentiality Impact: High (C:H) – Private key is fully recovered.
• Integrity Impact: High (I:H) – Attacker can sign arbitrary data.
• Availability Impact: High (A:H) – Can disrupt services via unauthorized access.

Threat Level: Critical. The attack is practical, requires minimal resources, and has severe consequences for key compromise and supply-chain integrity.

Deep Dive & Mechanics

The vulnerability lies in the ECDSA nonce generation for the NIST P-521 curve in PuTTY's sshpubk.c file. The nonce (k) is generated using a flawed random number generator that produces biased output. Specifically, the nonce is derived from a 512-bit random value, but for P-521, the nonce must be 521 bits. The implementation truncates the random value, leading to a nonce that is not uniformly distributed across the full 521-bit range. This bias allows an attacker to recover the private key using lattice reduction techniques (e.g., LLL algorithm) after collecting about 60 signatures.

The attack exploits the fact that ECDSA signatures reveal information about the nonce. With biased nonces, the attacker can set up a system of linear equations and solve for the private key. The required signatures can be obtained from public Git repositories (commit signatures) or by running a malicious SSH server that the victim connects to.

Key Technical Details:

• Affected Curve: NIST P-521 (secp521r1)
• Nonce Generation: Uses random_upto() with a 512-bit seed, but P-521 requires 521 bits.
• Bias: The nonce is biased towards lower values, making it predictable.
• Attack Complexity: Approximately 60 signatures needed for key recovery.
• Tooling: Public proof-of-concept code exists (e.g., using SageMath for lattice reduction).

Vulnerable vs. Patched Code

Vulnerable Code (PuTTY 0.80):

// In sshpubk.c, nonce generation for ECDSA
Bignum nonce = random_upto(512); // 512-bit random
// For P-521, nonce should be 521 bits
// This truncation introduces bias

Patched Code (PuTTY 0.81):

// Corrected nonce generation
Bignum nonce = random_upto(521); // Now uses full 521-bit range
// Ensures uniform distribution

The fix ensures that the nonce is generated with the correct bit length for the curve, eliminating the bias. All dependent software (FileZilla, WinSCP, TortoiseGit, TortoiseSVN) have incorporated this fix in their respective updates.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Python 3.x with ecdsa and sage libraries
• A set of ~60 ECDSA signatures from a vulnerable PuTTY client
• The public key of the victim

Attack Steps:

1. Collect Signatures: Obtain signatures from public Git commits or by running a malicious SSH server.
2. Extract Nonce Information: Parse the signatures to extract (r, s) values.
3. Lattice Attack: Use SageMath to perform lattice reduction and recover the private key.

Example Script (Conceptual):

# This is a simplified representation; actual attack uses lattice reduction
from ecdsa import NIST521p, SigningKey
from sage.all import *

# Assume we have 60 signatures (r_i, s_i) and message hashes (h_i)
# Recover private key using LLL
# ... (full exploit code available in public repositories)

Lab Setup:

• Set up a vulnerable PuTTY 0.80 client.
• Configure Pageant to use a P-521 key.
• Generate 60+ signatures by signing dummy messages.
• Run the lattice attack to recover the private key.

Blue Team (Defense & Detection)

Detection Steps:

1. Identify Vulnerable Versions: Scan for PuTTY < 0.81, FileZilla < 3.67.0, WinSCP < 6.3.3, TortoiseGit < 2.15.0.1, TortoiseSVN <= 1.14.6.
2. Monitor for Anomalous Signatures: Look for a high volume of ECDSA signatures from the same key in a short period.
3. Check Git Repositories: Review commit signatures for unusual patterns or multiple signatures from the same key.

Mitigation:

• Immediately upgrade all affected software.
• Revoke and regenerate any P-521 keys used with vulnerable versions.
• Rotate SSH keys and update authorized_keys files.
• Enable multi-factor authentication for Git operations.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual number of SSH connections from a single IP to multiple services.
  • SSH authentication attempts using compromised keys.
• File IOCs:
  • Presence of PuTTY 0.68-0.80 binaries.
  • ECDSA private keys with P-521 curve generated by vulnerable versions.
• Behavioral IOCs:
  • Sudden appearance of unauthorized commits in Git repositories.
  • SSH agent forwarding enabled on untrusted hosts.
• Signature IOCs:
  • ECDSA signatures with biased nonces (detectable via statistical analysis).

Detection Engineering

YARA Rule

rule CVE_2024_31497_PuTTY_Vulnerable {
    meta:
        description = "Detects PuTTY binaries vulnerable to CVE-2024-31497"
        author = "Valters IT"
        date = "2024-04-16"
        hash = "sha256: <insert hash of vulnerable binary>"
    strings:
        $vuln_string = "random_upto(512)" ascii wide nocase
        $p521_curve = "NIST P-521" ascii wide nocase
    condition:
        $vuln_string and $p521_curve
}

Sigma Rule

title: CVE-2024-31497 - Biased ECDSA Nonce in PuTTY
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-31497 by monitoring for a high number of ECDSA signatures
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        ProcessName: 'putty.exe'
        CommandLine: '*ssh*'
    condition: selection
falsepositives:
    - Legitimate use of PuTTY for SSH connections
level: high

Suricata Rule

alert tcp any any -> any 22 (msg:"CVE-2024-31497 - Potential ECDSA Key Recovery Attack"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade PuTTY to version 0.81 or later.
2. Update dependent software:
   • FileZilla to 3.67.0+
   • WinSCP to 6.3.3+
   • TortoiseGit to 2.15.0.1+
   • TortoiseSVN to 1.14.7+
3. Revoke and regenerate all P-521 keys that were used with vulnerable versions.
4. Rotate SSH keys and update authorized_keys on all servers.
5. Audit Git repositories for unauthorized commits or suspicious signatures.

Long-Term Mitigations:

• Disable SSH agent forwarding when not strictly necessary.
• Use hardware security keys (e.g., YubiKey) for SSH authentication.
• Implement certificate-based SSH authentication.
• Monitor for anomalous SSH activity using SIEM solutions.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For further assistance, contact your security team.