CVE-2024-54143

Executive Summary

CVE-2024-54143 is a critical vulnerability in the OpenWrt Image on Demand Server (ASU). The vulnerability stems from a weak request hashing mechanism that truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate hash collisions. By exploiting this, a previously built malicious image can be served in place of a legitimate one, allowing the attacker to "poison" the artifact cache and deliver compromised firmware images to unsuspecting users. This can be combined with other attacks, such as a command injection in Imagebuilder, resulting in the production of malicious firmware images signed with the legitimate build key.

Supply Chain & Package Security

This vulnerability directly impacts the OpenWrt firmware supply chain. By poisoning the artifact cache, an attacker can serve malicious firmware images to users, compromising the integrity of the entire distribution. The attack can be combined with command injection in Imagebuilder to produce malicious images signed with the legitimate build key, making detection extremely difficult.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is required.
• User Interaction (UI): None (N) - No user interaction is needed.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) - Complete loss of confidentiality.
• Integrity (I): High (H) - Complete loss of integrity.
• Availability (A): High (H) - Complete loss of availability.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows for remote, unauthenticated cache poisoning, leading to the distribution of malicious firmware.

Deep Dive & Mechanics

The OpenWrt ASU (Attended SysUpgrade) server uses a request hashing mechanism to cache and serve firmware images. The hash is computed from the request parameters (e.g., target, version, packages). The vulnerability lies in the truncation of the SHA-256 hash to only 12 characters (48 bits). This reduces the effective entropy from 256 bits to 48 bits, making it feasible to find collisions using a birthday attack.

Attack Flow:

1. Collision Generation: An attacker generates a large number of request hashes (e.g., by varying package lists) until they find a collision with a legitimate request hash.
2. Malicious Image Build: The attacker builds a malicious firmware image (e.g., with a backdoor) using the same request parameters that produce the colliding hash.
3. Cache Poisoning: The attacker sends a request to the ASU server with the colliding hash. The server checks its cache and, if the hash matches, serves the malicious image instead of the legitimate one.
4. Distribution: Unsuspecting users requesting the legitimate firmware receive the malicious image, which may be signed with the legitimate build key if combined with a command injection attack.

Technical Details:

• The hash is truncated to 12 characters, which is 48 bits (12 * 4 bits per hex character).
• A birthday attack on a 48-bit hash requires approximately 2^24 (16.7 million) attempts to find a collision with 50% probability.
• This is computationally feasible with modern hardware (e.g., a few hours on a GPU cluster).

Vulnerable vs. Patched Code

Vulnerable Code (before 920c8a1):

# Example of vulnerable hash generation
import hashlib

def generate_hash(request_data):
    full_hash = hashlib.sha256(request_data.encode()).hexdigest()
    # Truncated to 12 characters
    truncated_hash = full_hash[:12]
    return truncated_hash

Patched Code (after 920c8a1):

# Example of patched hash generation
import hashlib

def generate_hash(request_data):
    full_hash = hashlib.sha256(request_data.encode()).hexdigest()
    # Use full hash (64 characters)
    return full_hash

The patch removes the truncation, restoring the full 256-bit entropy of SHA-256.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate cache poisoning by generating a hash collision.

Prerequisites:

• Access to the ASU server (e.g., a local instance or a public one).
• Ability to send HTTP requests to the server.
• A tool for generating hash collisions (e.g., a custom script).

Steps:

1. Identify a Target Request: Choose a legitimate firmware request (e.g., target=ath79/generic&version=23.05.0&packages=luci-ssl).
2. Generate Collisions: Write a script that varies the packages parameter and computes the truncated hash until a collision is found.

import hashlib
import itertools
import string

def truncated_hash(data):
    return hashlib.sha256(data.encode()).hexdigest()[:12]

target_hash = truncated_hash("target=ath79/generic&version=23.05.0&packages=luci-ssl")

# Brute force collision by varying package names
for i in range(1000000):
    packages = "package_" + str(i)
    request = f"target=ath79/generic&version=23.05.0&packages={packages}"
    if truncated_hash(request) == target_hash:
        print(f"Collision found: {request}")
        break

3. Build Malicious Image: Use the colliding request parameters to build a malicious firmware image (e.g., with a backdoor).
4. Poison Cache: Send a request to the ASU server with the colliding hash. The server will cache the malicious image under the same hash as the legitimate one.
5. Serve Malicious Image: Subsequent requests for the legitimate firmware will now receive the malicious image.

Blue Team

Objective: Detect and prevent cache poisoning attacks.

Detection:

• Monitor for multiple requests with the same hash but different parameters.
• Monitor for requests with unusually long or complex package lists (indicating collision generation attempts).
• Monitor for hash collisions in the cache (e.g., two different requests mapping to the same hash).

Prevention:

• Apply the patch (commit 920c8a1) immediately.
• Implement rate limiting on requests to slow down collision generation.
• Use a stronger hashing mechanism (e.g., full SHA-256).
• Add a nonce or timestamp to the hash input to prevent replay attacks.

Indicators of Compromise (IOCs)

• Network:
  • Multiple HTTP requests to the ASU server with the same hash but different parameters.
  • Requests with a high number of package variations in a short period.
• System:
  • Unexpected firmware images in the cache directory.
  • Hash collisions in the cache database.
• File:
  • Firmware images with unexpected hashes (e.g., different from the expected SHA-256).

Detection Engineering

YARA Rule

rule CVE_2024_54143_Cache_Poisoning {
    meta:
        description = "Detects attempts to exploit CVE-2024-54143 by generating hash collisions"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-54143"
    strings:
        $hash_pattern = /[0-9a-f]{12}/  // 12-character hex hash
        $request_pattern = /target=.*&version=.*&packages=.*/
    condition:
        #hash_pattern > 10 and #request_pattern > 10
}

Sigma Rule

title: CVE-2024-54143 - OpenWrt ASU Cache Poisoning Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects multiple requests with the same hash but different parameters to the OpenWrt ASU server
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "hash="
    condition: selection
falsepositives:
    - Legitimate requests with the same hash (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54143 - OpenWrt ASU Cache Poisoning Attempt"; flow:to_server; content:"hash="; http_uri; pcre:"/[0-9a-f]{12}/"; threshold:type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the Patch: Update the ASU server to commit 920c8a1 or later.
2. Invalidate Cache: Clear the existing cache to remove any potentially poisoned images.
3. Verify Firmware Integrity: Users should verify the integrity of downloaded firmware images using the full SHA-256 hash.

Long-Term Mitigations:

1. Implement Rate Limiting: Limit the number of requests per IP address to slow down collision generation.
2. Use a Stronger Hash: Use the full SHA-256 hash (64 characters) instead of truncating.
3. Add a Nonce: Include a random nonce in the hash input to prevent replay attacks.
4. Monitor for Anomalies: Implement monitoring for hash collisions and unusual request patterns.

Valters IT