Possible Secret Information Leak in StormShield Network Security via CLI

Executive Summary

This vulnerability exists in StormShield Network Security (SNS) versions 4.3.0 to 4.3.41, 4.8.0 to 4.8.15, and 5.0.0 to 5.0.5. It involves a possible leak of secret information through the NSRPC client history when administrators use the CLI command line tool.

An attacker with SSH access to the firewall, if SSH multiuser mode is enabled, could potentially retrieve sensitive data such as the proxy CA passphrase or TPM password.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is the potential exposure of sensitive information like the proxy CA passphrase or TPM password to an attacker with SSH access and multiuser mode enabled.

The CVSS base score is 4.3, indicating a low severity with limited impact. The exploit requires adjacent network access, low attack complexity, high privileges, and user interaction.

This vulnerability does not affect system integrity or availability, but it could compromise confidentiality by leaking secret credentials.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update your Stormshield Network Security (SNS) devices to the fixed versions: 5.0.6, 4.8.16, or 4.3.42 depending on your current version.

There is no available workaround, so applying the update is the only effective immediate step.

Additionally, consider restricting SSH access and disabling SSH multiuser mode if it is enabled, to reduce the risk of unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves a possible leak of secret information such as the proxy CA passphrase or TPM password when administration commands are passed using the CLI tool on StormShield Network Security devices.

Such a leak of sensitive information could potentially impact compliance with standards and regulations like GDPR or HIPAA, which require protection of sensitive data and secure access controls.

However, the vulnerability requires SSH multiuser mode to be enabled and high privileges, limiting the scope of exposure. The CVSS score is low (4.3), indicating limited impact, and no system integrity or availability is affected.

No explicit mention of compliance impact or regulatory considerations is provided in the available resources.

Useful 0 Not Useful 0