OpenSSH CVE-2024-6387 (RegreSSHion) vulnerability could cause RCE to be subjected to mass exploitation?  - Phoenix Security

OpenSSH CVE-2024-6387 (RegreSSHion) vulnerability could cause RCE to be subjected to mass exploitation?

A new Vulnerability affecting OpenSSH, regression, with CVE identifier CVE-2024-6387 (named RegreSSHion), has been discovered, and wide exploitation is possible; in the article, we’ll explore the impact, the likelihood of this to happen and how to tackle external system upgrades with ASPM technologies quickly. This vulnerability affects OpenSSH, a widely used suite of secure networking utilities based on the Secure Shell (SSH) protocol. In this article, we delve into the details of CVE-2024-6387, its impact, the complexities involved in its exploitation, and how organizations can mitigate the associated risks.

The challenge of this vulnerability is that it could potentially impact tens of thousands of software being very popular SSH components and embedded in glibc.

CVE-2024-6387 #OpenSSH wild #Vulnerability regreSSHion Explained do you need to worry? - YouTube

CVE-2024-6387 #OpenSSH wild #Vulnerability regreSSHion Explained do you need to worry?

Could OpenSSH CVE-2024-6387 (RegreSSHion) vulnerability cause RCE to be subjected to mass exploitation?

“The vulnerability, which is a signal handler race condition in OpenSSH’s server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems,” Bharat Jogi, senior director of the threat research unit at Qualys

Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with address space layout randomization,” OpenSSH said in an advisory. “Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept.

Key points about CVE-2024-6387:

• Vulnerability: Remote Unauthenticated Code Execution (CVE-2024-6387)
• Affected: OpenSSH 8.5p1 to 9.8p1
• Architecture: Primary PoC for 32-bit (x86), 64-bit (amd64) theoretically vulnerable
• Systems: glibc-based Linux distributions
• Impact: Root-level access if exploited
• Complexity: High (requires precise timing, multiple attempts)
• Status: Patch available (OpenSSH 9.8p1)

Note:

Qualys describes the vulnerability as highly complex to exploit, requiring an average of around 10,000 exploitation attempts to succeed.

under ideal conditions, you can perform about 5 attempts per minute, so 10,000 attempts would take around 1.4 days. This is also in a lab environment where network lag is negligible, as is SSH background noise. On a real internet-connected system experiencing network jitter and being blasted by SSH scanners, exploitation could take significantly longer.

What Does OpenSSH Stand For?

OpenSSH stands for Open Secure Shell. It is an open-source implementation of the SSH protocol, which provides encrypted communication sessions over unsecured networks. OpenSSH includes a set of secure networking utilities designed to offer robust encryption, secure file transfers, and secure remote logins, making it an essential tool for administrators and developers managing servers and networked systems.

What is OpenSSH Vulnerability?

An OpenSSH vulnerability refers to a security flaw found within the OpenSSH software that can be exploited by attackers to compromise system security. The regreSSHion vulnerability (CVE-2024-6387) is a prime example. It is a signal handler race condition in the OpenSSH server component (sshd), allowing unauthenticated remote code execution (RCE) with root privileges on glibc-based Linux systems. This makes it a critical threat, as it could potentially allow attackers to gain full control over affected systems.

What is the Difference Between SSH and OpenSSH in RegreSSHion?

SSH, or Secure Shell, is a protocol used to secure remote logins and other network services over an unsecured network. OpenSSH is an open-source implementation of the SSH protocol, providing a suite of tools that include SSH clients and servers, as well as utilities for secure file transfers and other secure network operations. While SSH is the protocol itself, OpenSSH is a widely used implementation of that protocol.

Where is OpenSSH Used?

OpenSSH is used in a variety of environments to ensure secure communication and data transfer. It is commonly deployed for remote server management, secure file transfers, automated backups, and batch processing. OpenSSH’s robust security features and flexibility make it a cornerstone in DevOps practices, where secure handling of sensitive data across multiple systems and locations is crucial.

What is Regression? Why CVE-2024-6387 has been named RegreSSHion?

In software development, regression refers to the reappearance of a previously fixed bug or vulnerability in a subsequent software release. This can occur due to changes or updates that inadvertently reintroduce the issue. The regreSSHion vulnerability is a regression of the previously patched CVE-2006-5051, highlighting the importance of thorough regression testing to prevent known vulnerabilities from re-entering the environment.

What Systems Are Affected?

The regreSSHion vulnerability affects glibc-based Linux systems running vulnerable versions of OpenSSH. Specifically, it impacts versions from 8.5p1 to 9.7p1. Versions earlier than 4.4p1 are also vulnerable unless they have been patched for both CVE-2006-5051 and CVE-2008-4109. Notably, OpenBSD systems are unaffected due to a security mechanism implemented in 2001.

Are There Exploits for CVE-2024-6387?

When it comes to cybersecurity, understanding the exploitation potential of a vulnerability is crucial. The regreSSHion vulnerability, identified as CVE-2024-6387, is no exception. This section delves into the existence and complexity of exploits for this vulnerability, shedding light on the practical challenge potential attackers face.

Proof-of-Concept (PoC) for CVE-2024-6387

As of the latest update, a Proof-of-Concept (PoC) for CVE-2024-6387 exists. This PoC targets certain i386 (32-bit) versions of OpenSSH where the GNU C Library (glibc) is at a static base address. This scenario bypasses Address Space Layout Randomization (ASLR), a security feature that randomizes memory addresses to make exploitation more difficult. In systems where ASLR is not bypassed, the complexity and time required to exploit the vulnerability increase significantly.

How to remediate CVE-2024-6387?

With Phoenix security, you can search for active campaigns.

How to identify CVE-2024-6387?

We amended some of the script to identify the vulnerable version and to output the vulnerabilities that can be imported into Phoenix Security.

https://github.com/Security-Phoenix-demo/CVE-2024-6387_Check_phoenix_Security

Scanning for CVE-20246387 can be simple, and there are at least a couple of scripts that enable the identification of the vulnerability.

Exploitation Complexity CVE-2024-6387

Qualys’ whitepaper highlights the high complexity involved in exploiting CVE-2024-6387. Under lab conditions, it took an average of around 10,000 exploitation attempts to succeed. Several factors contribute to this complexity:

• Login Timeout: The exploitation process is restricted by the login timeout setting, which ranges between 120 to 600 seconds.
• Concurrent Connections: OpenSSH typically allows a maximum of 10 concurrent unauthenticated connections.
• Exploitation Rate: Under ideal conditions, this setup permits about five attempts per minute. Thus, achieving 10,000 attempts would take approximately 1.4 days.

These conditions are based on an ideal lab environment with negligible network lag and minimal SSH background noise. In real-world scenarios, factors such as network jitter and interference from SSH scanners could extend the exploitation timeframe significantly.

How many systems are exposed to CVE-2024-6387

Qualys’ whitepaper highlights the high complexity involved in exploiting CVE-2024-6387. Currently, there are around 61,800 openssh exposed systems according to shodan

Advanced Exploitation Techniques CVE-2024-6387

While the PoC provides a starting point, successful exploitation of CVE-2024-6387 in a real-world environment is challenging. Attackers would need to:

• Overcome ASLR: On modern systems (x86_64 / AMD64), ASLR significantly complicates the exploitation process.
• Handle Network Latency: Real-world networks introduce latency and jitter, making precise timing of exploitation attempts more difficult.
• Mitigate Background Noise: The presence of legitimate and illegitimate SSH traffic can obscure exploitation attempts, requiring additional measures to isolate and execute the attack.

Realistic Threat Assessment

Given these complexities, it is unlikely that CVE-2024-6387 will see widespread in-the-wild exploitation similar to other high-severity vulnerabilities. However, the possibility remains that sophisticated attackers could develop more efficient methods over time. Organizations must remain vigilant and prioritize patching and other mitigations to protect against potential exploitation.

Mitigation Strategies

To mitigate the risks associated with CVE-2024-6387, organizations should:

1. Apply Patches Promptly: Ensure that all systems running vulnerable versions of OpenSSH are updated to the latest secure versions.
2. Limit SSH Access: Use network-based controls to restrict SSH access to trusted IP addresses and employ VPNs where possible.
3. Implement Network Segmentation: Separate critical systems from less secure parts of the network.
4. Monitor and Alert: Deploy and configure intrusion detection and prevention systems to detect and alert on exploitation attempts.

How Could I Discover If I’m Affected by CVE-2024-6387?

To determine if you are affected by CVE-2024-6387, check the version of OpenSSH running on your systems. If your version falls within the vulnerable range (8.5p1 to 9.7p1, or earlier than 4.4p1 without patches), you are at risk.

What Version of OpenSSH is Vulnerable to CVE-2024-6387?

The versions of OpenSSH vulnerable to CVE-2024-6387 are from 8.5p1 up to, but not including, 9.8p1. Versions earlier than 4.4p1 are also vulnerable unless patched for CVE-2006-5051 and CVE-2008-4109. Ensuring your OpenSSH installation is updated beyond these versions is critical to mitigate the risk.

The Complexity of Exploiting CVE-2024-6387

According to Qualys’ whitepaper, exploiting CVE-2024-6387 is highly complex. It requires an average of around 10,000 exploitation attempts to succeed under lab conditions, restricted by various factors:

Update (2024-07-01 11:09 PST)

There does appear to be a proof-of-concept (PoC) for certain i386 (32-bit) versions of OpenSSH where glibc is at a static base address, eliminating the need for an ASLR bypass.

The Impact of regreSSHion

The impact of the regreSSHion vulnerability is far-reaching, given the widespread use of OpenSSH. A successful exploit could lead to a full system compromise, allowing attackers to execute arbitrary code with root privileges. Qualys’ findings indicate that there are no less than 14 million potentially vulnerable OpenSSH server instances exposed to the internet.

Mitigating the Risks of regreSSHion

To mitigate the risks associated with CVE-2024-6387, organizations should take several key steps:

1. Patch Management: Apply the latest patches for OpenSSH immediately.
2. Access Control: Limit SSH access.
3. Network Segmentation: Implement network segmentation to restrict unauthorized access.
4. Monitoring and Alerting: Deploy intrusion detection and prevention systems.

Conclusion

The regreSSHion vulnerability (CVE-2024-6387) in OpenSSH underscores the importance of rigorous security practices and timely patch management. The risks are significant with millions of potentially vulnerable instances exposed to the internet. However, organizations can mitigate these risks and protect their critical assets by understanding the complexity of exploitation, implementing security measures, and leveraging solutions like those offered by Phoenix Security ASPM.