CVE-2024-37386

Executive Summary

CVE-2024-37386 is a security vulnerability in Stormshield Network Security (SNS) appliances that allows an attacker with physical or administrative access to bypass Secure Boot protections and restart the device in single-user mode. This bypass undermines the integrity guarantees provided by Secure Boot, potentially allowing an attacker to load unsigned or malicious code during the boot process, gain elevated privileges, or persist on the device. The vulnerability affects SNS versions 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Patches are available in versions 4.3.27, 4.7.6, and 4.8.2. No public proof-of-concept or exploit code has been identified at this time.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a network security appliance.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is unusual and likely indicates that a full CVSS vector has not been assigned or published by NVD at the time of analysis. Based on the description, the vulnerability requires physical or administrative access to the device, which significantly reduces the attack surface. However, the impact is high as it bypasses a critical security control (Secure Boot). A reasonable estimated CVSS vector would be:

Estimated CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Estimated Base Score: 6.8 (Medium)

Breakdown:

• Attack Vector (AV): Physical (P) – Requires physical access to the appliance.
• Attack Complexity (AC): Low (L) – The manipulation is described as "certain manipulations," implying no special conditions.
• Privileges Required (PR): None (N) – No authentication needed if physical access is obtained.
• User Interaction (UI): None (N) – No user action required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability affects the same security authority.
• Confidentiality (C): High (H) – Single-user mode can allow access to all data on the device.
• Integrity (I): High (H) – Bypassing Secure Boot allows loading unsigned code, compromising system integrity.
• Availability (A): High (H) – An attacker could disrupt normal operation or install persistent malware.

Threat Level: Medium. The requirement for physical access limits remote exploitation, but the impact on integrity and confidentiality is severe for affected devices.

Deep Dive & Mechanics

The vulnerability lies in the boot process of Stormshield Network Security appliances. Secure Boot is a security standard designed to ensure that a device boots using only software that is trusted by the original equipment manufacturer (OEM). When the device starts, the firmware checks the signature of each piece of boot software, including the bootloader, kernel, and critical system files.

In affected SNS versions, the implementation of Secure Boot has a flaw. An attacker with physical access to the device (or administrative access to the operating system) can perform "certain manipulations" that allow the device to restart in single-user mode, bypassing the Secure Boot verification process. Single-user mode typically provides a root shell with full system access, without requiring authentication.

The exact manipulation is not publicly detailed, but it likely involves:

1. Interrupting the boot process (e.g., pressing a specific key combination during startup).
2. Modifying boot parameters (e.g., via GRUB or U-Boot command line).
3. Exploiting a race condition or logic error in the Secure Boot implementation that allows fallback to an unsigned boot path.

Once in single-user mode, an attacker can:

• Mount the filesystem and modify system binaries.
• Install a persistent backdoor or rootkit.
• Extract sensitive configuration data, including VPN keys and firewall rules.
• Disable security features permanently.

Vulnerable vs. Patched Code

No specific code diff is publicly available. The vulnerability is in the proprietary boot firmware of Stormshield SNS. The patch likely involves:

• Strengthening the Secure Boot chain to prevent fallback to single-user mode.
• Adding authentication requirements for entering single-user mode.
• Validating boot parameters against a trusted list.

Vulnerable Behavior:

• The bootloader allows an attacker to pass kernel command-line parameters (e.g., single or init=/bin/sh) without proper signature verification.
• The system does not require a password or cryptographic token to enter single-user mode.

Patched Behavior:

• The bootloader verifies the integrity of all boot parameters.
• Single-user mode requires a valid administrator password or a signed token.
• The Secure Boot chain is enforced even during recovery or maintenance modes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Physical access to a vulnerable Stormshield SNS appliance (versions 4.0.0-4.3.25, 4.4.0-4.7.5, or 4.8.0).
• Ability to connect a keyboard and monitor to the device (or serial console access).

Exploitation Steps:

1. Power on or reboot the SNS appliance.
2. Interrupt the boot process. This is typically done by pressing a key (e.g., Esc, Del, or F2) during the BIOS/UEFI or bootloader splash screen. The exact key may vary by model.
3. Access the bootloader command line. For example, if the device uses GRUB, you might press e to edit the boot entry.
4. Modify the kernel command line. Append parameters to boot into single-user mode. Common parameters include:
   • single
   • init=/bin/bash
   • systemd.unit=rescue.target
5. Boot the system. The device will start in single-user mode, providing a root shell without a password prompt.
6. Perform post-exploitation actions:
   • Remount the root filesystem as read-write: mount -o remount,rw /
   • Add a new user: useradd -m -G wheel attacker
   • Set a password: passwd attacker
   • Install a backdoor (e.g., SSH key, cron job, or kernel module).
   • Extract configuration files: tar czf /tmp/config.tgz /etc/ /var/

Example Boot Parameter Manipulation (GRUB):

# At the GRUB menu, press 'e' to edit the selected entry.
# Find the line starting with 'linux' or 'kernel'.
# Append ' single' to the end of that line.
# Press Ctrl+X or F10 to boot.

Note: No public exploit code (e.g., from Exploit-DB) is available for this CVE.

Blue Team

Detection and Prevention:

1. Physical Security: Restrict physical access to SNS appliances. Use locked server racks, CCTV, and access logs.
2. Boot Password: Configure a BIOS/UEFI password to prevent unauthorized modification of boot settings.
3. Secure Boot Enforcement: Ensure Secure Boot is enabled and properly configured in the firmware settings.
4. Audit Logs: Monitor system logs for unexpected reboots or boot parameter changes. Look for entries indicating single-user mode entry.
5. Integrity Monitoring: Use file integrity monitoring (FIM) tools to detect changes to critical system files (e.g., /etc/passwd, /etc/shadow, /boot/).
6. Patch Management: Apply the vendor-supplied patches (versions 4.3.27, 4.7.6, or 4.8.2) as soon as possible.

Hunting Queries:

• Search for log entries containing "single-user", "rescue", or "emergency" mode.
• Look for unexpected SSH key additions in /root/.ssh/authorized_keys.
• Monitor for new user accounts created outside of normal administrative procedures.

Indicators of Compromise (IOCs)

• System Logs:
  • systemd logs showing entry into rescue or emergency mode.
  • auth.log or secure logs showing successful root login without a password.
  • Bootloader logs indicating modified kernel command line.
• File System Changes:
  • New or modified files in /boot/ (e.g., unsigned kernel images).
  • Unexpected entries in /etc/passwd or /etc/shadow.
  • New SSH keys in /root/.ssh/authorized_keys.
  • Suspicious cron jobs in /etc/cron.d/ or /var/spool/cron/.
• Network Indicators:
  • Outbound connections to unknown IP addresses from the SNS appliance.
  • Unexpected listening ports.
• Process Indicators:
  • Unusual processes running as root (e.g., reverse shells, cryptocurrency miners).

Detection Engineering

YARA Rule

rule CVE_2024_37386_Stormshield_SecureBoot_Bypass {
    meta:
        description = "Detects indicators of CVE-2024-37386 exploitation on Stormshield SNS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-37386"
        severity = "high"
    strings:
        $s1 = "single" ascii wide nocase
        $s2 = "init=/bin/bash" ascii wide nocase
        $s3 = "systemd.unit=rescue.target" ascii wide nocase
        $s4 = "emergency" ascii wide nocase
        $s5 = "Secure Boot violation" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3, $s4) or $s5
}

Sigma Rule

title: Stormshield SNS Secure Boot Bypass via Single-User Mode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects events indicating a potential exploitation of CVE-2024-37386 on Stormshield SNS appliances.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37386
logsource:
    product: stormshield
    service: sns
detection:
    selection:
        EventID:
            - 1000  # System boot
            - 1001  # System shutdown
            - 1102  # Security log cleared
        Message:
            - "*single*"
            - "*rescue*"
            - "*emergency*"
            - "*init=/bin/bash*"
    condition: selection
falsepositives:
    - Legitimate administrative recovery procedures
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37386 Stormshield SNS Potential Backdoor Communication"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"|ff ff ff ff|"; within:4; reference:cve,2024-37386; classtype:attempted-admin; sid:1000001; rev:1;)

Note: The Suricata rule above is a generic example for detecting potential backdoor communication. A more specific rule would require knowledge of the attacker's command and control (C2) protocol.

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade affected SNS appliances to the following fixed versions:
   • SNS 4.3.x: Upgrade to 4.3.27 or later.
   • SNS 4.7.x: Upgrade to 4.7.6 or later.
   • SNS 4.8.x: Upgrade to 4.8.2 or later.
2. Physical Access Control: Ensure that only authorized personnel have physical access to the appliances. Implement multi-factor authentication for console access.
3. BIOS/UEFI Password: Set a strong password for the firmware settings to prevent unauthorized modification of boot parameters.

Long-Term Mitigations:

1. Configuration Management: Use a centralized management system (e.g., Stormshield Management Center) to enforce consistent security policies and monitor for unauthorized changes.
2. Logging and Monitoring: Enable detailed logging of all boot events and system changes. Forward logs to a SIEM for analysis.
3. Regular Audits: Conduct periodic security audits of SNS configurations and physical security controls.
4. Vendor Communication: Subscribe to Stormshield security advisories to receive timely updates on vulnerabilities.

Workarounds (if patching is not immediately possible):

• Disable USB ports and other external interfaces that could be used to inject boot parameters.
• Implement strict physical security measures, such as tamper-evident seals and surveillance.
• Monitor for any signs of unauthorized access or system modification.

Valters IT
DevSecOps & Cyber Threat Intelligence