TUF (The Update Framework), Metadata Rollback Vulnerability, CVE-2023-XXXX (Critical)

By /

Listen to this Post

How the CVE Works

The vulnerability occurs in TUF clients when updating the snapshot role. The system fails to verify whether previously encountered delegated targets metadata files remain present in new snapshots. Additionally, it does not enforce version checks for delegated targets metadata, unlike its handling of standard targets metadata. This oversight allows attackers to remove or roll back delegated targets metadata to older versions, bypassing security checks. Consequently, the client may trust and download outdated or malicious targets, undermining the integrity of software updates.

DailyCVE Form

Platform: TUF
Version: <0.20.0
Vulnerability: Metadata Rollback
Severity: Critical
Date: YYYY-MM-DD

What Undercode Say:

Analytics:

  • Attack Vector: Exploits missing version validation in delegated targets metadata.
  • Impact: Allows downgrade attacks, leading to execution of outdated/malicious code.
  • Affected Systems: TUF clients using `tough` library versions below 0.20.0.

Exploitation:

  1. Manipulate Metadata: Modify `delegated_targets.json` to reference older versions.
  2. Bypass Checks: Snapshot updates accept rolled-back metadata due to missing validation.
  3. Serve Malicious Payload: Client downloads outdated targets, enabling code execution.

Protection:

  • Patch Immediately: Upgrade to `tough` ≥0.20.0.
  • Manual Validation: Implement custom checks for delegated targets metadata versions.
  • Monitor Updates: Verify snapshot metadata integrity before applying updates.

Commands:

Check installed `tough` version:
pip show tough
Upgrade to patched version:
pip install --upgrade tough==0.20.0

Code Snippet (Metadata Validation):

from tough import TUFClient
def validate_delegated_metadata(client):
delegated_targets = client.get_delegated_targets()
if not delegated_targets or delegated_targets.version < last_known_version:
raise SecurityError("Invalid delegated targets metadata")

Detection:

  • Log Analysis: Flag snapshot updates with missing/decreased delegated targets versions.
  • Tooling: Use TUF compliance checkers to audit metadata history.

References:

References:

Reported By: https://github.com/advisories/GHSA-q6r9-r9pw-4cf7
Extra Source Hub:
Undercode

Join Our Cyber World:

💬 Whatsapp | 💬 TelegramFeatured Image

Scroll to Top