CVE-2020-18685
📋 TL;DR
CVE-2020-18685 is an input validation vulnerability in Floodlight SDN controller that allows attackers to bypass security checks and potentially execute arbitrary code or disrupt network operations. It affects Floodlight installations through version 1.2 due to insufficient validation of TCP/UDP ports, group IDs, and table IDs in the StaticFlowEntryPusherResource component.
💻 Affected Systems
- Floodlight SDN Controller
📦 What is this software?
Floodlight by Atlassian
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete compromise of the SDN controller, enabling network-wide disruption, data interception, or lateral movement to connected systems.
Likely Case
Network flow manipulation allowing unauthorized traffic redirection, denial of service to specific network segments, or bypassing of security policies.
If Mitigated
Limited impact if proper network segmentation and controller access controls are implemented, potentially only affecting isolated management networks.
🎯 Exploit Status
Exploitation requires network access to Floodlight REST API (typically port 8080). The vulnerability is in the checkFlow function which fails to validate input parameters properly.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.1 or later
Vendor Advisory: https://github.com/floodlight/floodlight
Restart Required: Yes
Instructions:
1. Download Floodlight 1.2.1 or later from official repository. 2. Stop Floodlight service. 3. Replace existing installation with patched version. 4. Restart Floodlight service. 5. Verify functionality.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to Floodlight REST API to trusted management networks only
iptables -A INPUT -p tcp --dport 8080 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disable Static Flow Pusher
allTemporarily disable the vulnerable StaticFlowEntryPusherResource module
Edit floodlightdefault.properties: net.floodlightcontroller.staticflowentry.StaticFlowEntryPusher.enable=false
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Floodlight controller from untrusted networks
- Deploy network monitoring to detect anomalous flow modification attempts
🔍 How to Verify
Check if Vulnerable:
Check Floodlight version: grep 'version' floodlight/logs/floodlight.log or examine build propertiesCheck Version:
java -jar floodlight.jar --versionVerify Fix Applied:
Verify version is 1.2.1 or later and test StaticFlowEntryPusher API with invalid parameters to ensure proper validation📡 Detection & Monitoring
Log Indicators:
- Invalid parameter errors in StaticFlowEntryPusher logs
- Unexpected flow modification requests
- Failed validation messages
Network Indicators:
- Unusual REST API requests to port 8080 with malformed parameters
- Abnormal OpenFlow message patterns
SIEM Query:
source="floodlight.log" AND ("StaticFlowEntryPusher" OR "checkFlow") AND (error OR invalid OR exception)