CVE-2024-42450: Versa Director Auth Bypass Vulnerability

CVE-2024-42450 Overview

CVE-2024-42450 is a critical hardcoded credentials vulnerability affecting Versa Director, a network management platform used for SD-WAN deployments. The vulnerability stems from a dangerous combination of a default common password shared across all Versa Director instances and PostgreSQL being configured to listen on all network interfaces by default. This configuration flaw allows unauthenticated remote attackers to access and administer the PostgreSQL database or read local filesystem contents, potentially leading to full system compromise and privilege escalation.

Critical Impact

Unauthenticated attackers can remotely access the PostgreSQL database, administer it with full privileges, read local filesystem contents, and escalate privileges on the system. This affects operational and configuration data storage as well as High Availability functions.

Affected Products

• Versa Director (versions prior to 22.1.4)
• Versa Director High Availability deployments using PostgreSQL
• Versa Director instances without published Firewall guidelines implemented

Discovery Timeline

• 2024-11-19 - CVE CVE-2024-42450 published to NVD
• 2024-11-19 - Last updated in NVD database

Technical Details for CVE-2024-42450

Vulnerability Analysis

This vulnerability represents a severe insecure default configuration flaw categorized under CWE-798 (Use of Hard-coded Credentials). The Versa Director platform relies on PostgreSQL for storing operational and configuration data, as well as enabling High Availability functionality between Director instances.

The core issue lies in two compounding misconfigurations present in the default installation. First, all Versa Director instances are deployed with an identical, common password for PostgreSQL access. Second, PostgreSQL is configured to bind to all network interfaces (0.0.0.0), making it accessible from any network that can reach the Director system.

An attacker who can reach the PostgreSQL port (typically 5432) can authenticate using the known default credentials without any prior authorization. This grants them complete administrative access to the database containing sensitive operational and configuration data. Furthermore, PostgreSQL's ability to interact with the local filesystem through functions like pg_read_file() enables attackers to read sensitive files and escalate privileges on the underlying system.

Root Cause

The root cause is the use of hardcoded credentials combined with an overly permissive network configuration. By shipping all Versa Director instances with the same PostgreSQL password and configuring the database to listen on all interfaces, the vendor created a situation where any network-accessible Director instance is vulnerable to unauthenticated database access. This violates fundamental security principles around unique credentials and principle of least privilege for network exposure.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker simply needs network connectivity to the PostgreSQL port on a Versa Director instance. The attack flow involves connecting to the PostgreSQL service using standard database clients, authenticating with the known default credentials, and then executing queries to extract configuration data, operational information, or leveraging PostgreSQL's filesystem access capabilities to read sensitive files and escalate privileges.

The exploitation of this vulnerability does not require sophisticated techniques—standard PostgreSQL client tools can be used to connect and interact with the database once the default credentials are known. According to Versa Networks, a proof of concept exists in lab environments, though exploitation in production systems has not been observed.

Detection Methods for CVE-2024-42450

Indicators of Compromise

• Unexpected connections to PostgreSQL port (5432) from external or unauthorized IP addresses
• Database queries accessing sensitive tables or using filesystem functions like pg_read_file()
• Authentication logs showing successful PostgreSQL logins from unknown sources
• Evidence of data exfiltration from the Versa Director database

Detection Strategies

• Monitor network traffic for connections to PostgreSQL port 5432 from non-peer Versa Director systems
• Implement database activity monitoring to detect unusual query patterns or filesystem access attempts
• Review PostgreSQL authentication logs for connections from unexpected IP addresses
• Deploy network intrusion detection rules to identify PostgreSQL protocol traffic from unauthorized sources

Monitoring Recommendations

• Enable comprehensive logging for PostgreSQL authentication and query execution
• Configure alerts for any database connections originating outside the expected Versa Director cluster
• Implement network segmentation monitoring to detect lateral movement attempts
• Review Versa Director system logs for indicators of privilege escalation or unauthorized file access

How to Mitigate CVE-2024-42450

Immediate Actions Required

• Upgrade to Versa Director version 22.1.4 or later, which automatically restricts access to Postgres and HA ports
• Implement firewall rules to restrict PostgreSQL access to only local and peer Versa Director systems
• Verify that published Versa Networks Firewall guidelines are properly implemented
• Audit existing Versa Director deployments for signs of compromise

Patch Information

Versa Networks has released version 22.1.4 of Versa Director, which automatically restricts access to the Postgres and HA ports to only the local and peer Versa Directors. Organizations should upgrade to this version immediately. The software can be downloaded from the Versa Networks Support Portal.

For additional security information, refer to the Versa Networks Email Bulletin.

Workarounds

• Perform manual hardening of HA ports following Versa's System Hardening Guide
• Implement network-level restrictions to block external access to PostgreSQL ports
• Deploy firewall rules per Versa Networks published guidelines, which prevent exploitation of this vulnerability
• Contact Versa Technical Support or your Versa account team for assistance with hardening procedures

# Example firewall rule to restrict PostgreSQL access (adapt to your environment)
# Only allow PostgreSQL connections from peer Versa Director IP addresses
iptables -A INPUT -p tcp --dport 5432 -s <PEER_DIRECTOR_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -j DROP