CVE-2024-29960: Brocade SANnav Information Disclosure Flaw

CVE-2024-29960 Overview

CVE-2024-29960 is a hardcoded cryptographic key vulnerability [CWE-798] in Brocade SANnav server before v2.3.1 and v2.3.0a. The SSH keys embedded in the official OVA image are identical across every deployment of the virtual machine. Any SANnav VM based on the official OVA images shares the same private SSH host keys. An attacker on an adjacent network can decrypt SSH traffic through a man-in-the-middle (MITM) position and compromise the SSH session to the SANnav appliance. The flaw affects the confidentiality, integrity, and availability of management sessions used to administer Storage Area Network (SAN) infrastructure.

Critical Impact
Attackers with adjacent network access can perform SSH MITM attacks against any SANnav VM deployed from the affected OVA images, exposing administrative credentials and management traffic.

Affected Products

Broadcom Brocade SANnav server versions before v2.3.1
Broadcom Brocade SANnav server v2.3.0a and earlier
Any SANnav VM instance provisioned from the official OVA images prior to remediation

Discovery Timeline

2024-04-19 - CVE-2024-29960 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29960

Vulnerability Analysis

The Brocade SANnav Open Virtualization Appliance (OVA) ships with pre-generated SSH host keys embedded in the disk image. When administrators deploy the OVA to create a new SANnav VM, the appliance does not regenerate unique host keys on first boot. Every SANnav VM built from the same OVA release therefore presents identical SSH host key fingerprints.

SSH host keys anchor the trust model between clients and servers. When multiple servers share the same private key, any party with a copy of that key can impersonate any of them. An attacker who extracts the private key from a publicly obtainable OVA image gains the material required to intercept and decrypt SSH traffic across all installations.

The vulnerability is mapped to [CWE-798: Use of Hard-coded Credentials]. It permits interception of administrative sessions used to manage Fibre Channel SAN fabrics, storage switches, and connected storage arrays.

Root Cause

The root cause is the packaging of static SSH host keys inside the OVA distribution image. The VM provisioning workflow lacks a first-boot process to generate fresh host key material unique to each instance. Any operator or attacker who downloads the OVA can extract /etc/ssh/ssh_host_*_key files and reuse them against production deployments.

Attack Vector

An attacker requires adjacent network access to a network segment carrying SSH traffic to a SANnav VM. The attacker extracts the private SSH host keys from the publicly distributed OVA image. Using techniques such as ARP spoofing or rogue gateway insertion, the attacker positions themselves between an administrator and the SANnav host. Because the attacker holds the matching private key, the SSH handshake completes without triggering a host key mismatch warning on the client. The attacker then decrypts, records, or modifies the session, capturing administrative credentials and SAN management commands in transit.

The vulnerability manifests entirely in the OVA build and provisioning process. See the Broadcom Security Advisory #23244 for vendor technical details.

Detection Methods for CVE-2024-29960

Indicators of Compromise

Duplicate SSH host key fingerprints observed across independently deployed SANnav VMs
Unexpected ARP table changes or gateway redirections on management network segments serving SANnav
SSH client warnings that were previously suppressed for SANnav hosts, or logins from unusual source addresses
Anomalous administrative commands issued to SAN fabric switches following SANnav SSH sessions

Detection Strategies

Enumerate SSH host key fingerprints (ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub) on every SANnav VM and confirm each host presents a unique key
Compare fingerprints against the known-static keys published in the affected OVA images to identify unremediated instances
Inspect network flow telemetry for SSH sessions to SANnav management IPs originating from unexpected subnets or hosts

Monitoring Recommendations

Continuously monitor administrative access to SANnav and correlate SSH session events with SAN fabric configuration changes
Alert on ARP anomalies, MAC address changes, and duplicate IP conditions on VLANs carrying SAN management traffic
Log and review SSH authentication events for privileged accounts used to manage Brocade infrastructure

How to Mitigate CVE-2024-29960

Immediate Actions Required

Upgrade SANnav to v2.3.1 or later, which addresses the static SSH key packaging issue
Regenerate SSH host keys on every SANnav VM previously deployed from an affected OVA image before returning it to production
Restrict management network access to SANnav using segmentation, jump hosts, and firewall rules that limit SSH to trusted administrator subnets
Rotate administrator credentials that may have traversed potentially intercepted SSH sessions

Patch Information

Broadcom addresses this issue in Brocade SANnav v2.3.1. Deployments running v2.3.0a or earlier remain vulnerable until upgraded and until host keys are regenerated on already-provisioned VMs. Refer to Broadcom Security Advisory #23244 for release details.

Workarounds

Manually delete and regenerate SSH host keys on each SANnav VM: remove /etc/ssh/ssh_host_* files and restart sshd to generate fresh key material
Isolate SANnav management interfaces on a dedicated, encrypted administrative VLAN with strict access control lists
Require administrators to verify SSH host key fingerprints out-of-band before accepting new connections to SANnav

bash

# Regenerate SSH host keys on an affected SANnav VM
sudo rm -f /etc/ssh/ssh_host_*
sudo ssh-keygen -A
sudo systemctl restart sshd

# Verify the new fingerprints are unique per host
for k in /etc/ssh/ssh_host_*_key.pub; do ssh-keygen -lf "$k"; done