CVE-2020-18683
📋 TL;DR
CVE-2020-18683 is an input validation vulnerability in Floodlight SDN controller's StaticFlowEntryPusherResource.java that allows attackers to execute arbitrary code through undefined fields mishandling. This affects all Floodlight installations through version 1.2. Network administrators using Floodlight for software-defined networking are at risk.
💻 Affected Systems
- Floodlight SDN Controller
📦 What is this software?
Floodlight by Atlassian
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete compromise of the SDN controller, allowing attacker to manipulate network flows, intercept traffic, or pivot to other network segments.
Likely Case
Unauthenticated remote code execution resulting in SDN controller compromise and potential network manipulation.
If Mitigated
Limited impact if network segmentation isolates the controller and proper input validation is implemented.
🎯 Exploit Status
The vulnerability is in a REST API endpoint that handles flow entries. Exploitation requires sending specially crafted JSON payloads to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.1 or later
Vendor Advisory: https://github.com/floodlight/floodlight
Restart Required: Yes
Instructions:
1. Download Floodlight version 1.2.1 or later from official repository. 2. Stop the Floodlight service. 3. Replace the existing installation with the patched version. 4. Restart the Floodlight service.
🔧 Temporary Workarounds
Disable StaticFlowEntryPusher REST API
allTemporarily disable the vulnerable REST API endpoint until patching can be completed.
Edit floodlightdefault.properties and set net.floodlightcontroller.staticflowentry.web.StaticFlowEntryPusher.enable=false
Restart Floodlight service
Network Access Control
linuxRestrict network access to Floodlight REST API endpoints using firewall rules.
iptables -A INPUT -p tcp --dport 8080 -s trusted_networks -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Floodlight controller from untrusted networks
- Deploy web application firewall (WAF) rules to filter malicious JSON payloads targeting the StaticFlowEntryPusher endpoint
🔍 How to Verify
Check if Vulnerable:
Check Floodlight version: if version is 1.2 or earlier, the system is vulnerable. Test by sending a crafted JSON payload with undefined fields to /wm/staticflowentrypusher/json endpoint.Check Version:
java -jar floodlight.jar --version or check the version in floodlight.propertiesVerify Fix Applied:
Verify Floodlight version is 1.2.1 or later. Test that malformed JSON payloads with undefined fields are properly rejected by the StaticFlowEntryPusher endpoint.📡 Detection & Monitoring
Log Indicators:
- Unusual JSON parsing errors in Floodlight logs
- Multiple failed attempts to access /wm/staticflowentrypusher/json endpoint
- Unexpected process execution from Floodlight context
Network Indicators:
- Unusual traffic patterns to Floodlight REST API port (default 8080)
- Malformed JSON payloads sent to /wm/staticflowentrypusher/json
SIEM Query:
source="floodlight.log" AND ("StaticFlowEntryPusher" OR "undefined field" OR "JSON parsing error")