CVE-2024-10943: Authentication Bypass Vulnerability

CVE-2024-10943 Overview

An authentication bypass vulnerability exists in Rockwell Automation products due to shared secrets across accounts. The vulnerability allows a threat actor to impersonate a legitimate user if they are able to enumerate additional information required during authentication. This flaw stems from insecure storage of sensitive information (CWE-922), where shared secrets used for authentication are not properly isolated between different user accounts.

Critical Impact

This authentication bypass vulnerability could allow unauthorized users to impersonate legitimate accounts, potentially gaining full access to industrial control systems and critical infrastructure.

Affected Products

• Rockwell Automation Products (refer to Rockwell Automation Security Advisory SD1710 for specific affected versions)

Discovery Timeline

• November 12, 2024 - CVE-2024-10943 published to NVD
• November 13, 2024 - Last updated in NVD database

Technical Details for CVE-2024-10943

Vulnerability Analysis

This authentication bypass vulnerability represents a significant security flaw in the affected Rockwell Automation products. The core issue lies in the improper handling of authentication secrets, where shared credentials are used across multiple user accounts rather than maintaining unique secrets per account.

When authentication secrets are shared across accounts, an attacker who gains knowledge of one account's authentication parameters may be able to leverage that information to authenticate as other users. This vulnerability is classified under CWE-922 (Insecure Storage of Sensitive Information), indicating that the secrets are not adequately protected or segregated.

The network-accessible nature of this vulnerability means attackers can attempt exploitation remotely without requiring local access to the target system. However, successful exploitation requires the attacker to enumerate additional authentication information, which adds some complexity to the attack.

Root Cause

The vulnerability exists due to the use of shared secrets across multiple user accounts within the authentication mechanism. This design flaw violates the security principle of credential isolation, where each user account should maintain unique authentication credentials. The insecure storage of these shared secrets allows potential cross-account authentication if an attacker can gather the necessary supplementary information.

Attack Vector

The attack vector for CVE-2024-10943 is network-based, allowing remote exploitation. A threat actor would need to:

1. Identify a target system running the vulnerable Rockwell Automation software
2. Enumerate or obtain information about the shared authentication secrets
3. Gather additional required authentication parameters
4. Craft authentication requests that impersonate legitimate users

The vulnerability does not require user interaction for exploitation, though it does require the attacker to successfully enumerate the additional authentication information needed. This represents a pre-authentication attack that could grant unauthorized access to industrial control systems.

Detection Methods for CVE-2024-10943

Indicators of Compromise

• Unusual authentication patterns showing single credentials accessing multiple distinct user accounts
• Failed authentication attempts followed by successful logins from the same source IP but different user accounts
• Authentication requests with anomalous timing patterns suggesting automated enumeration attempts

Detection Strategies

• Monitor authentication logs for accounts being accessed from unexpected IP addresses or geographic locations
• Implement behavioral analytics to detect authentication patterns inconsistent with normal user behavior
• Deploy network intrusion detection rules to identify potential enumeration attacks against authentication endpoints
• Review audit logs for privilege escalation or access to resources outside normal user scope

Monitoring Recommendations

• Enable detailed authentication logging on all Rockwell Automation products
• Configure alerts for authentication anomalies including multiple account access from single sources
• Implement real-time monitoring of authentication endpoints for signs of credential stuffing or enumeration
• Establish baseline authentication patterns to facilitate anomaly detection

How to Mitigate CVE-2024-10943

Immediate Actions Required

• Review the Rockwell Automation Security Advisory SD1710 for specific remediation guidance
• Apply vendor-provided patches or updates as they become available
• Implement network segmentation to limit access to affected systems from untrusted networks
• Enable additional authentication controls such as multi-factor authentication where supported

Patch Information

Rockwell Automation has published a security advisory (SD1710) addressing this vulnerability. Organizations should consult the official security advisory for specific patch information, affected product versions, and detailed remediation instructions.

Workarounds

• Restrict network access to affected systems to trusted IP addresses and networks only
• Implement network segmentation to isolate industrial control systems from general corporate networks
• Deploy additional authentication layers such as VPN requirements or network access control
• Monitor and audit all authentication attempts to affected systems for suspicious activity
• Consider implementing allowlisting for systems that can authenticate to the affected products