CVE-2024-29950
📋 TL;DR
CVE-2024-29950 is a cryptographic vulnerability in Brocade SANnav's FileTransfer class that uses the deprecated ssh-rsa signature scheme with SHA-1 hashing. This allows remote, unauthenticated attackers to perform man-in-the-middle attacks by exploiting SHA-1 collision weaknesses. Organizations using Brocade SANnav before patched versions are affected.
💻 Affected Systems
- Brocade SANnav
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept and manipulate all SANnav management traffic, potentially gaining administrative access to storage networks, modifying configurations, or exfiltrating sensitive storage data.
Likely Case
Attackers intercept specific management sessions to capture credentials, modify configuration files during transfer, or inject malicious commands into the management system.
If Mitigated
With proper network segmentation and monitoring, impact is limited to potential interception of specific management sessions rather than full network compromise.
🎯 Exploit Status
Exploitation requires network positioning for MITM attacks but leverages well-known cryptographic weaknesses in SHA-1.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.3.1 or v2.3.0a
Vendor Advisory: https://support.broadcom.com/external/content/SecurityAdvisories/0/23236
Restart Required: Yes
Instructions:
1. Download SANnav v2.3.1 or v2.3.0a from Broadcom support portal. 2. Backup current configuration. 3. Apply the update following Broadcom's upgrade documentation. 4. Restart the SANnav appliance.
🔧 Temporary Workarounds
Network Segmentation
allIsolate SANnav management traffic to trusted networks only
SSH Configuration Hardening
linuxConfigure SSH clients to reject ssh-rsa signatures if possible
ssh -o PubkeyAcceptedAlgorithms=-ssh-rsa user@host
🧯 If You Can't Patch
- Segment SANnav management network from untrusted networks
- Implement certificate pinning or SSH host key verification for all SANnav connections
🔍 How to Verify
Check if Vulnerable:
Check SANnav version via web interface or CLI. Versions before 2.3.1/2.3.0a are vulnerable.Check Version:
From SANnav CLI: show versionVerify Fix Applied:
Verify version is 2.3.1 or 2.3.0a and test SSH connections to confirm ssh-rsa is not accepted.📡 Detection & Monitoring
Log Indicators:
- Unexpected SSH connection failures
- Multiple SSH renegotiation attempts
- SSH connections using ssh-rsa signatures
Network Indicators:
- Unusual SSH traffic patterns to SANnav management ports
- SSH protocol anomalies indicating MITM attempts
SIEM Query:
source="sannav" AND (event="ssh_failure" OR protocol="ssh" AND signature="ssh-rsa")