CVE-2023-41591
📋 TL;DR
CVE-2023-41591 is an authentication bypass vulnerability in ONOS SDN controller that allows attackers to spoof IP/MAC addresses. This enables man-in-the-middle attacks on network communications between hosts. Organizations using ONOS v2.7.0 for software-defined networking are affected.
💻 Affected Systems
- Open Network Foundation ONOS
📦 What is this software?
Onos by Opennetworking
⚠️ Risk & Real-World Impact
Worst Case
Complete network compromise allowing interception, modification, and redirection of all traffic between hosts, potentially leading to data theft, service disruption, and lateral movement.
Likely Case
Selective traffic interception and manipulation between specific hosts, enabling data exfiltration, credential theft, and service disruption.
If Mitigated
Limited impact through network segmentation and monitoring, with potential for isolated traffic manipulation if other controls fail.
🎯 Exploit Status
Exploit requires network access but no authentication. Public proof-of-concept available in GitHub gist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.7.1 or later
Vendor Advisory: https://wiki.onosproject.org/pages/viewpage.action?pageId=16122675
Restart Required: Yes
Instructions:
1. Backup current ONOS configuration. 2. Download and install ONOS v2.7.1 or later from official repository. 3. Restart ONOS service. 4. Verify version and functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate ONOS controller network from untrusted networks using firewalls and VLANs
MAC Address Filtering
allImplement strict MAC address filtering on network switches to prevent spoofing
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach ONOS controller
- Deploy network monitoring and IDS/IPS to detect and block spoofing attempts
🔍 How to Verify
Check if Vulnerable:
Check ONOS version: if running v2.7.0, system is vulnerableCheck Version:
onos-version or check /opt/onos/VERSION fileVerify Fix Applied:
Verify ONOS version is v2.7.1 or later and test IP/MAC address validation functionality📡 Detection & Monitoring
Log Indicators:
- Unexpected IP/MAC address registrations
- Multiple hosts with same MAC
- ARP spoofing alerts
Network Indicators:
- Unusual ARP traffic
- Duplicate IP addresses
- Unexpected MAC address changes
SIEM Query:
source="onos" AND ("duplicate mac" OR "spoof" OR "unauthorized registration")