CVE-2024-45236
📋 TL;DR
This vulnerability in FORT RPKI validator allows a malicious RPKI repository to crash the software by serving a signed object with an empty signedAttributes field. This leads to Route Origin Validation unavailability, potentially compromising BGP routing security. Organizations using FORT as an RPKI Relying Party are affected.
💻 Affected Systems
- FORT RPKI validator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of Route Origin Validation leading to BGP hijacking attacks, route leaks, and compromised internet routing infrastructure.
Likely Case
Service disruption of FORT validator causing temporary loss of RPKI validation until service restart, potentially allowing malicious route announcements during downtime.
If Mitigated
Limited service interruption with quick detection and restart, minimal routing impact due to redundancy or alternative validation mechanisms.
🎯 Exploit Status
Exploitation requires control of a malicious RPKI repository that descends from a trusted Trust Anchor, which an attacker could potentially create or compromise.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.3
Vendor Advisory: https://nicmx.github.io/FORT-validator/CVE.html
Restart Required: Yes
Instructions:
1. Download FORT 1.6.3 or later from official repository. 2. Stop FORT service. 3. Install/upgrade to patched version. 4. Restart FORT service. 5. Verify service is running correctly.
🔧 Temporary Workarounds
Repository filtering
linuxConfigure FORT to only connect to trusted RPKI repositories and implement repository allowlisting
# Configure repository allowlist in FORT configuration
# Example: fort --repository-trust=https://trusted-repo.example.com
🧯 If You Can't Patch
- Implement redundant RPKI validation with alternative software (Routinator, rpki-client)
- Monitor FORT process health and implement automatic restart on crash detection
🔍 How to Verify
Check if Vulnerable:
Check FORT version with 'fort --version' command, vulnerable if version < 1.6.3Check Version:
fort --versionVerify Fix Applied:
Verify version is 1.6.3 or higher and monitor for crashes when processing RPKI objects📡 Detection & Monitoring
Log Indicators:
- FORT process crashes
- Segmentation fault errors in logs
- RPKI validation service stopped unexpectedly
Network Indicators:
- Unusual RPKI repository connections
- Suspicious rsync/RRDP traffic patterns
SIEM Query:
process.name="fort" AND (event.action="crashed" OR log.level="error" AND message="segmentation fault")