CVE-2024-45237
📋 TL;DR
This vulnerability allows a malicious RPKI repository to trigger a buffer overflow in FORT validator versions before 1.6.3 by serving a specially crafted resource certificate with an oversized Key Usage extension. Attackers could potentially execute arbitrary code or crash the service. Organizations using FORT for RPKI validation are affected.
💻 Affected Systems
- FORT validator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the FORT process, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.
Likely Case
Service crash (denial of service) disrupting RPKI validation and potentially affecting BGP routing security.
If Mitigated
Limited to service disruption if proper segmentation and least privilege controls are implemented.
🎯 Exploit Status
Exploitation requires the attacker to control or compromise a downstream RPKI repository from a trusted Trust Anchor.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.3
Vendor Advisory: https://nicmx.github.io/FORT-validator/CVE.html
Restart Required: Yes
Instructions:
1. Download FORT 1.6.3 or later from the official repository. 2. Stop the FORT service. 3. Install the updated version following the platform-specific installation guide. 4. Restart the FORT service.
🔧 Temporary Workarounds
Temporary repository filtering
linuxConfigure FORT to only sync with trusted RPKI repositories and block untrusted sources at network level.
# Configure FORT's TAL files to only include trusted repositories
# Use firewall rules to block rsync/RRDP from untrusted sources
🧯 If You Can't Patch
- Disable FORT service if RPKI validation is not critical for your environment.
- Implement strict network segmentation to isolate FORT instances from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check the FORT version with 'fort --version' or examine the installed package version. Versions below 1.6.3 are vulnerable.Check Version:
fort --versionVerify Fix Applied:
After updating, run 'fort --version' to confirm version 1.6.3 or higher is installed and verify the service starts without errors.📡 Detection & Monitoring
Log Indicators:
- FORT service crashes or unexpected termination
- Error messages related to certificate parsing or buffer overflows in system logs
Network Indicators:
- Unusual rsync or RRDP traffic patterns from RPKI repositories
- Multiple connection attempts to FORT from suspicious sources
SIEM Query:
source="fort.log" AND ("crash" OR "segmentation fault" OR "buffer overflow")