CVE-2024-107785: Crux Agent Pre-Shared Key Rotation Flaw with SHA-512

Vulnerability Overview Vulnerability Name: CVE-2024-107785 Description: Crux Agent fails to correctly perform pre-shared key rotation upon silent failure when SHA-512 is used for peer negotiation. Severity: Medium (CVSS v4.0.3) Affected Product: Crux Agent 1.9.0 to 2.0.2 Fixed Version: Crux Agent 2.0.3 Impact Scope Affected Products: Crux Agent 1.9.0 to 2.0.2 Specific Impact: In a peer session, if a 32-byte bidirectional key is not successfully negotiated, Crux Agent does not validate the key's size. Instead, it attempts to update the tunnel using the command, writing an invalid key to the WireGuard configuration file. This causes the tunnel startup to fail until the tunnel is closed and restarted. An attacker can intercept and store peer traffic, and access (or have the ability to access) a quantum computing computer to decrypt the tunnel. Remediation Upgrade: Upgrade to Crux Agent 2.0.3 or later, which truncates SHA keys to 32 bytes. Workaround: As a mitigation, remove the "hash function" from custom settings and use the default SHA-256 hash function in the agent configuration. POC Code or Exploit Code No specific POC code or exploit code is provided on the page. Additional Information Publication Date: October 9, 2024 Reporter: Sirius Computer, Inc. Contact Email: cve-coordination@sirius.computer --- Summary: Vulnerability Overview: Crux Agent fails to correctly perform pre-shared key rotation upon silent failure when SHA-512 is used for peer negotiation. Impact Scope: Crux Agent 1.9.0 to 2.0.2 Remediation: Upgrade to Crux Agent 2.0.3 or later, or remove the "hash function" from custom settings and use the default SHA-256 hash function.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-107785: Crux Agent Pre-Shared Key Rotation Flaw with SHA-512