CVE-2024-29959
📋 TL;DR
This vulnerability in Brocade SANnav management software exposes encrypted switch passwords in support save files from standby nodes. Attackers with access to these files could potentially decrypt passwords, compromising SAN switch credentials. Organizations using Brocade SANnav before v2.3.1 or v2.3.0a are affected.
💻 Affected Systems
- Brocade SANnav
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain encrypted passwords, decrypt them, gain administrative access to SAN switches, and potentially disrupt or compromise entire storage networks.
Likely Case
Insiders or attackers with access to support files extract encrypted passwords, potentially leading to credential theft and unauthorized SAN access.
If Mitigated
With proper access controls, the impact is limited as support files are protected, but credential exposure risk remains if files are accessed.
🎯 Exploit Status
Exploitation requires access to support save files, typically through compromised accounts or insider access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.3.1 or v2.3.0a
Vendor Advisory: https://support.broadcom.com/external/content/SecurityAdvisories/0/23243
Restart Required: Yes
Instructions:
1. Download Brocade SANnav v2.3.1 or v2.3.0a from Broadcom support. 2. Backup current configuration. 3. Apply update following vendor documentation. 4. Restart SANnav services. 5. Verify version update.
🔧 Temporary Workarounds
Restrict Support Save File Access
linuxLimit access to support save files and directories containing them to prevent unauthorized viewing.
chmod 600 /path/to/support/save/files/*
chown root:root /path/to/support/save/files/*
Disable Automatic Support Save
allConfigure SANnav to not automatically generate or retain support save files containing sensitive data.
Consult SANnav documentation for support save configuration settings
🧯 If You Can't Patch
- Implement strict access controls on SANnav systems and support save directories
- Monitor and audit access to support save files and SANnav administrative interfaces
🔍 How to Verify
Check if Vulnerable:
Check SANnav version via web interface or CLI. Versions before v2.3.1 and v2.3.0a are vulnerable.Check Version:
sannav --version or check web interface administration panelVerify Fix Applied:
Confirm SANnav version is v2.3.1 or v2.3.0a. Test that support save files no longer contain encrypted passwords.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access to support save files
- Multiple support save generation attempts
- Access to SANnav administrative interfaces from unusual sources
Network Indicators:
- Unusual SANnav management traffic patterns
- Unexpected connections to SANnav ports
SIEM Query:
source="sannav" AND (event="support_save" OR event="file_access") AND user!="authorized_user"