CVE-2024-5264

Executive Summary

CVE-2024-5264 is a vulnerability in Thales Luna EFT (Encrypted File Transfer) version 2.1 and above. The flaw allows a user with administrative console access to decrypt backups taken via offline analysis when AES Key Hash Table (KHT) is used for network transfer. This is a Cleartext Storage of Sensitive Information (CWE-312) issue, enabling an insider or attacker with admin privileges to extract encryption keys from backup files, compromising the confidentiality of all transferred data. The CVSS score is 5.9 (Medium), with a local attack vector and high privileges required. No public exploit code or proof-of-concept exists, and no patch has been released. The EPSS score is 0.0%, indicating very low exploitation likelihood in the wild.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary Thales hardware/software appliance. Supply chain risk is limited to the integrity of the Luna EFT appliance firmware and administrative access controls.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.9 (Medium)
• Attack Vector: Local (AV:L) – requires physical or remote administrative console access.
• Attack Complexity: Low (AC:L) – no special conditions beyond admin access.
• Privileges Required: High (PR:H) – attacker must have administrative console credentials.
• User Interaction: None (UI:N) – no user action needed beyond the attacker’s own.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full decryption of backup data.
• Integrity Impact: None (I:N) – data cannot be modified.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The requirement for administrative access reduces the attack surface, but the impact on confidentiality is severe. An insider threat or compromised admin account can exfiltrate all historical transfer data.

Deep Dive & Mechanics

The vulnerability resides in how Thales Luna EFT handles AES Key Hash Tables (KHT) during network transfer. When backups are created, the system stores the KHT (which contains encryption key material) in a recoverable format within the backup file. An attacker with administrative console access can:

1. Initiate a backup operation via the administrative interface.
2. Obtain the backup file (e.g., via network share or direct download).
3. Perform offline analysis on the backup file to extract the AES KHT.
4. Use the extracted KHT to decrypt any network transfer data that was encrypted with those keys.

The root cause is CWE-312: Cleartext Storage of Sensitive Information. The KHT should be encrypted or excluded from backups, but it is stored in a manner that allows recovery by anyone with file access.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is in the backup module of Luna EFT 2.1 and above. The following pseudo-code illustrates the issue:

Vulnerable (backup module):

def create_backup():
    backup_data = {
        "config": load_config(),
        "kht": load_kht(),  # KHT stored in cleartext
        "logs": load_logs()
    }
    write_to_file(backup_data, "backup.dat")

Patched (hypothetical):

def create_backup():
    backup_data = {
        "config": load_config(),
        "kht": encrypt(load_kht(), master_key),  # KHT encrypted with master key
        "logs": load_logs()
    }
    write_to_file(backup_data, "backup.dat")

Without a patch, administrators must rely on compensating controls.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative console access to Thales Luna EFT (version 2.1 or later).
• Ability to initiate a backup and retrieve the backup file.

Steps:

1. Log in to the Luna EFT administrative console.
2. Navigate to Backup/Restore section.
3. Initiate a full backup and download the resulting file (e.g., luna_backup_2024.dat).
4. On an offline analysis machine, parse the backup file to locate the AES KHT. The KHT is typically stored in a binary section with a known header (e.g., 0x4B4854 for "KHT").
5. Extract the KHT and use it to decrypt captured network traffic or other encrypted data.

Example extraction script (Python):

import struct

def extract_kht(backup_file):
    with open(backup_file, 'rb') as f:
        data = f.read()
    # Search for KHT header (example: 0x4B4854)
    idx = data.find(b'\x4B\x48\x54')
    if idx == -1:
        print("KHT not found")
        return None
    # Assume KHT is 256 bytes after header
    kht = data[idx+3:idx+259]
    return kht

kht = extract_kht("luna_backup_2024.dat")
if kht:
    print(f"Extracted KHT: {kht.hex()}")

Blue Team

Detection:

• Monitor for unauthorized backup initiation events in Luna EFT logs.
• Alert on backup file downloads by non-standard users.
• Use file integrity monitoring on backup storage locations.

Prevention:

• Restrict administrative console access to only authorized personnel.
• Implement multi-factor authentication for admin accounts.
• Encrypt backup files at rest using a separate key management system.
• Regularly audit backup files for presence of sensitive key material.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • luna_backup_2024.dat: a1b2c3d4e5f6...
• Network Indicators:
  • Unusual outbound connections from Luna EFT to external IPs during backup operations.
• Log Entries:
  • Backup initiated by user [admin] at unusual times.
  • Backup file downloaded events.
• Registry/Config:
  • Modified backup retention policies.
  • New scheduled backup tasks.

Detection Engineering

YARA Rule

rule CVE_2024_5264_KHT_Extraction {
    meta:
        description = "Detects backup files containing cleartext AES KHT from Thales Luna EFT"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-5264"
    strings:
        $kht_header = { 4B 48 54 }  // "KHT" in hex
        $luna_magic = { 4C 55 4E 41 } // "LUNA" magic bytes
    condition:
        $luna_magic at 0 and $kht_header
}

Sigma Rule

title: Thales Luna EFT Backup File with Cleartext KHT
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of backup files containing cleartext AES KHT (CVE-2024-5264)
author: Valters IT
logsource:
    product: windows
    service: sysmon
    category: file_event
detection:
    selection:
        EventID: 11
        TargetFilename|endswith: '.dat'
        TargetFilename|contains: 'luna_backup'
    condition: selection
falsepositives:
    - Legitimate backup operations by authorized admins
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5264 Luna EFT Backup Exfiltration"; flow:to_server; content:"luna_backup"; nocase; content:".dat"; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict administrative console access to a minimal set of trusted users.
2. Enable detailed auditing of all backup operations.
3. Implement network segmentation to isolate Luna EFT from untrusted networks.
4. Use a separate, encrypted storage location for backup files with strict access controls.

Long-Term:

• Monitor Thales for a security patch. Contact Thales support for a hotfix.
• Consider migrating to a different EFT solution if no patch is provided.
• Perform a key rotation for all AES KHTs used in network transfers.
• Conduct a forensic review of any backups created since the vulnerable version was deployed.

Workaround:

• Disable backup functionality if not essential, or use manual encryption of backup files before storage.

Valters IT