Cloudanix VulnDB

CVE-2024-56170

None

CVSS

—

EPSS

0.2%

Published

Dec 18, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in route validation software can let it accept old information instead of the newest data, potentially allowing incorrect network routing decisions.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

The product fails to compare manifestNumber and thisUpdate fields between newly fetched and cached RPKI manifests, accepting valid older manifests and rolling back route origin validation state.

Why it matters to the business

Organizations relying on this validator may use stale route authorization data, increasing risk of incorrect routing decisions or exposure to prefix hijacking until updated manifests are processed.

How an attack unfolds

An attacker positioned to serve RPKI data supplies a cryptographically valid but older manifest; the client accepts it without freshness checks against the cache, causing a rollback to prior validation state that persists until a newer manifest is fetched.

How to fix it

Upgrade Fort to version 2.0.0 or later. Verify that the update enforces manifest freshness comparison using manifestNumber and thisUpdate before caching.

How to confirm the fix worked

Confirm the installed version is 2.0.0 or newer, review release notes for manifest freshness enforcement, and test by serving an older valid manifest to verify rejection or replacement by newer data.

Typical attack path

  1. Identify targets running the vulnerable Fort version
  2. Obtain or craft a valid older RPKI manifest with lower manifestNumber or earlier thisUpdate
  3. Serve the outdated manifest via the repository the client polls
  4. Client accepts and caches the older manifest without recency comparison
  5. Route origin validation operates on the rolled-back data until a fresher manifest arrives

How to detect it

Review RPKI repository fetch logs for repeated acceptance of manifests with manifestNumber or thisUpdate values lower than previously seen; correlate with route origin validation state changes.

What your security team should do

  • Prioritize upgrade to 2.0.0 across all instances given the validation integrity flaw
  • Monitor EPSS trend and any emerging exploit code despite current low score
  • Add RPKI manifest fetch logs to SIEM for anomaly detection on manifestNumber decreases

The record

A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients are supposed to verify. Assuming everything else is correct, the most recent version of a manifest should be prioritized over other versions, to prevent replays, accidental or otherwise. Manifests contain the manifestNumber and thisUpdate fields, which can be used to gauge the relevance of a given manifest, when compared to other manifests. The former is a serial-like sequential number, and the latter is the date on which the manifest was created. However, the product does not compare the up-to-dateness of the most recently fetched manifest against the cached manifest. As such, it's prone to a rollback to a previous version if it's served a valid outdated manifest. This leads to outdated route origin validation.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 fort-validator 0 No fix
Debian:12 fort-validator 0 No fix
Debian:13 fort-validator 0 No fix
Ubuntu:20.04:LTS fort-validator 0 No fix
Ubuntu:22.04:LTS fort-validator 0 No fix
Ubuntu:24.04:LTS fort-validator 0 No fix
Ubuntu:24.10 fort-validator 0 No fix
Ubuntu:25.04 fort-validator 0 No fix
Ubuntu:25.10 fort-validator 0 No fix
Ubuntu:Pro:20.04:LTS fort-validator 0 No fix
Ubuntu:Pro:24.04:LTS fort-validator 0 No fix

Related vulnerabilities