CVE-2024-41254
📋 TL;DR
This vulnerability in litestream v0.3.13 disables SSH host key verification, allowing man-in-the-middle attackers to intercept and potentially modify data transmitted between litestream and remote databases. Anyone using litestream v0.3.13 with SSH connections to replicate databases is affected.
💻 Affected Systems
- litestream
📦 What is this software?
Litestream by Litestream
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept database replication traffic, steal sensitive data, inject malicious data, or disrupt database synchronization entirely.
Likely Case
Attackers intercept replication traffic to steal database contents or credentials, potentially leading to data breaches.
If Mitigated
With proper network segmentation and monitoring, impact is limited to potential data exposure without system compromise.
🎯 Exploit Status
Exploitation requires network access to intercept SSH traffic between litestream and remote database.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.3.14 or later
Vendor Advisory: https://github.com/benbjohnson/litestream
Restart Required: Yes
Instructions:
1. Stop litestream service. 2. Update to v0.3.14+. 3. Restart litestream service.
🔧 Temporary Workarounds
Use SSH known_hosts verification
allConfigure litestream to use proper SSH host key verification instead of InsecureIgnoreHostKey()
Modify litestream configuration to include SSH known_hosts file path
Use VPN or encrypted tunnel
allRoute litestream SSH traffic through VPN or other encrypted tunnel
🧯 If You Can't Patch
- Isolate litestream replication traffic to trusted network segments only
- Implement network monitoring for SSH man-in-the-middle attacks
🔍 How to Verify
Check if Vulnerable:
Check litestream version with 'litestream version' command and verify if v0.3.13Check Version:
litestream versionVerify Fix Applied:
Verify version is v0.3.14+ and check configuration doesn't use InsecureIgnoreHostKey()📡 Detection & Monitoring
Log Indicators:
- SSH connection warnings, failed host key verification attempts
Network Indicators:
- Unexpected SSH traffic patterns, MITM detection alerts
SIEM Query:
source="litestream" AND ("InsecureIgnoreHostKey" OR "host key verification failed")