NetWitness Platform: Node.js Multiple Vulnerabilities for UEBA service

[#1]

 

CVE Identifier:

CVE-2024-37372, CVE-2024-36137, CVE-2024-27980, CVE-2024-22020, CVE-2024-22018, CVE-2024-22019, CVE-2024-22017, CVE-2024-21896, CVE-2024-21892, CVE-2024-21891, CVE-2024-21890, CVE-2023-46809, CVE-2024-27983, CVE-2024-27982.

Details of the Vulnerabilities:

The version of Node.js installed on UEBA is 18.18.2, which is affected by multiple vulnerabilities as outlined in the Node.js vulnerability report. (https://nodejs.org/en/blog/vulnerability )

Latest nodejs security release (https://nodejs.org/en/blog/vulnerability/july-2024-security-releases ).

Severity:

CVE ID	NVD Severity	Nodejs Severity	NetWitness Severity	Comment
CVE-2024-22020	Medium(CNA)	Medium	None	NW is not impacted. Please refer to the details below for further information.
CVE-2024-22019	High(CNA)	High	None
CVE-2024-21892	High(CNA)	High	None
CVE-2023-46809	High(CNA)	Medium	None
CVE-2024-27983	High(CNA)	High	None
CVE-2024-27982	Medium(CNA)	Medium	None
CVE-2024-27980	High(CNA)	High	None	NW from version 12.4 are not impacted as RHEL8 is not affected.  https://access.redhat.com/security/cve/CVE-2024-27980
CVE-2024-37372	NA	Low	None	NW are not using the affected versions. The version used by NW is 18.18.2
CVE-2024-36137	Low(CNA)	Low	None
CVE-2024-22018	Low(CNA)	Low	None
CVE-2024-22017	High(CNA)	High	None
CVE-2024-21896	High(CNA)	High	None
CVE-2024-21891	High(CNA)	Medium	None
CVE-2024-21890	Medium(CNA)	Medium	None

Affected Products:

NetWitness Platform 12.5 and prior versions and if have the UEBA service installed.

Summary:

The NW Platform is not affected by the multiple security vulnerabilities related to Node.js. The vulnerable version of Node.js is installed as part of Kibana, but no vulnerable functions or activities are associated with it.

Details:

ID: CVE-2024-27982

Details: Critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.

NetWitness Impact:

The issue was due to the lack of a Content-Length header while using Connection reuse and not solely the space beforehand, which happened to trigger the issue as the header wasn't recognized.

Validated the reproducibility with the details in the reference and it resulted to a failed connection.

Netwitness is not impacted as it donot accept connections with malformed/unexpected headers and header details which resulted in failed connection.

Reference: https://hackerone.com/reports/2237099

ID: CVE-2024-27983

Details: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

NetWitness Impact:

The vulnerable Node.js version is installed as part of Kibana; however, it does not use or impact the HTTP/2 Server.

Reference: https://hackerone.com/reports/2319584

ID: CVE-2023-46809

Details: Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.

NetWitness Impact:

Vulnerable Node.js version is installed as part of Kibana, Hence it doesnot use OpenSSL which is the root cause of the vulnerability.

ID: CVE-2024-21892

Details: On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.

NetWitness Impact:

Vulnerable Node.js version is installed as part of Kibana, Hence it doesnot use CAP_NET_BIND_SERVICE which is the root cause of the vulnerability.

ID: CVE-2024-22019

Details: A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

NetWitness Impact:

Vulnerable Node.js version is installed as part of Kibana, Hence it doesnot use nor interfere with HTTP requests which is the root cause of the vulnerability.

ID: CVE-2024-22020

Details: A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.

NetWitness Impact:

Vulnerable Node.js version is installed as part of Kibana, Hence it impact nor interfere with any of the URL processing which is the root cause of the vulnerability.

Reference: https://hackerone.com/reports/2092749 ,  https://www.openwall.com/lists/oss-security/2024/07/11/6

Resolution:

Workaround: None

The following NetWitness Platform release contains resolutions to these vulnerabilities:  NetWitness Platform version 12.5.1.0

NetWitness recommends all customers upgrade at the earliest opportunity.

For additional documentation, downloads and more, visit the NetWitness Platform page on NetWitness Community.

Severity Rating

For an explanation of Severity Ratings, refer to Vulnerability Disclosure Policy. NetWitness recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.

EOPS policy:

NetWitness has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.

Legal Information:

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact RSA Customer Support. RSA Security LLC and its affiliates distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information.

RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without a warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement.

In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.