CVE-2020-24361
📋 TL;DR
CVE-2020-24361 is a critical remote code execution vulnerability in SNMPTT (SNMP Trap Translator) that allows attackers to execute arbitrary shell commands via EXEC, PREXEC, or unknown_trap_exec directives. This affects organizations using SNMPTT for SNMP trap processing, particularly those with untrusted SNMP trap sources. The vulnerability stems from improper input validation when processing SNMP trap data.
💻 Affected Systems
- SNMPTT (SNMP Trap Translator)
📦 What is this software?
Snmptt by Snmptt
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root/administrator privileges, allowing attackers to install malware, exfiltrate data, pivot to other systems, or establish persistent backdoors.
Likely Case
Unauthorized command execution with SNMPTT process privileges, potentially leading to service disruption, data manipulation, or lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation, SNMP source validation, and least privilege configurations restricting SNMPTT's execution capabilities.
🎯 Exploit Status
Exploitation requires sending specially crafted SNMP traps to the vulnerable SNMPTT instance. No authentication is needed if SNMPTT is configured to accept traps from the attacker's source.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.2 and later
Vendor Advisory: http://www.snmptt.org/changelog.shtml
Restart Required: Yes
Instructions:
1. Download SNMPTT 1.4.2 or later from http://www.snmptt.org/download.shtml
2. Stop SNMPTT service: 'systemctl stop snmptt' or equivalent
3. Backup current configuration files
4. Install new version following distribution-specific package management or compilation instructions
5. Restart SNMPTT service: 'systemctl start snmptt' or equivalent
🔧 Temporary Workarounds
Disable vulnerable directives
linuxRemove or comment out EXEC, PREXEC, and unknown_trap_exec directives from snmptt.conf file
sed -i 's/^EXEC/#EXEC/g' /etc/snmp/snmptt.conf
sed -i 's/^PREXEC/#PREXEC/g' /etc/snmp/snmptt.conf
sed -i 's/^unknown_trap_exec/#unknown_trap_exec/g' /etc/snmp/snmptt.conf
Restrict SNMP trap sources
linuxConfigure SNMPTT to only accept traps from trusted sources using firewall rules or SNMPTT configuration
iptables -A INPUT -p udp --dport 162 -s trusted_ip -j ACCEPT
iptables -A INPUT -p udp --dport 162 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SNMPTT systems from untrusted networks
- Run SNMPTT with minimal privileges using a dedicated non-root user account
🔍 How to Verify
Check if Vulnerable:
Check SNMPTT version: 'snmptt --version' or 'rpm -q snmptt' or 'dpkg -l | grep snmptt'. If version is below 1.4.2, check if EXEC/PREXEC/unknown_trap_exec directives exist in configuration: 'grep -E "^(EXEC|PREXEC|unknown_trap_exec)" /etc/snmp/snmptt.conf'Check Version:
snmptt --version 2>&1 | head -1Verify Fix Applied:
Verify SNMPTT version is 1.4.2 or higher: 'snmptt --version'. Test by sending a test SNMP trap with shell metacharacters to verify they are properly escaped.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in SNMPTT logs
- Suspicious SNMP trap patterns with shell metacharacters
- Failed command execution attempts in system logs
Network Indicators:
- SNMP traps containing shell metacharacters or command injection patterns
- Unexpected outbound connections from SNMPTT host
SIEM Query:
source="snmptt.log" AND ("EXEC" OR "PREXEC" OR "unknown_trap_exec") AND ("$" OR "|" OR ";" OR "`" OR "&" OR "(" OR ")")