A group of researchers from several American universities and the companies Cloudflare and Microsoft has developed a new attack technique on the RADIUS protocol, used by telecommunications operators, cloud services, and VPN providers for user authentication, authorization, and accounting. The attack, code-named Blast-RADIUS, enables the spoofing of the RADIUS server's response during authentication, allowing a subscriber to connect without knowing the access password.
To exploit the vulnerability (CVE-2024-3596), the attacker must have the ability to intercept transit traffic and conduct a full MITM attack, allowing them to read, intercept, block, and modify incoming and outgoing transit UDP packets sent by access points for client authentication requests (Access-Request) and returned by the RADIUS server with confirmation or rejection of the operation. By intercepting the authentication request, the attacker can send a forged response, specifying a different type of result (for example, Access-Accept instead of Access-Reject). The attacker may also potentially intercept the Access-Challenge response used in two-factor authentication and replace it with an Access-Accept response to bypass the additional verification step.
The attack is based on the fact that the RADIUS protocol uses UDP as its transport and verifies the integrity of the transmitted messages using the MD5 algorithm. For message verification, a secret key known only to the access point and the RADIUS server is used, but unknown to the attacker. proxy server In response to an authentication request, the RADIUS server generates an MD5 hash, which the access server can use to verify that the message was sent by an authorized server. The MD5 hash covers the random value sent in the request, the request identifier, returned attributes, and the secret key.
An attacker during a MITM attack can intercept the identifier and random value transmitted in the request, as well as predict the operation code, size, and attributes. The task is to create a valid checksum that corresponds to the altered result of the operation and passes the verification through hashing using a secret key. The MD5 algorithm is not resistant to collision attacks, allowing an attacker to manipulate the insignificant padding to find data combinations with the necessary parameters, whose MD5 hash will match the MD5 hash of the original response, and send a forged response with a successful authentication code (Access-Accept) instead of an error message.
Since no authentication or integrity checks are applied when processing packets with access requests (Access-Request), during the attack, the attacker can insert an additional attribute "Proxy-State" into the original access request. server The content of "Proxy-State" is selected considering the collision so that the value of the checksum MD5 hash in both the real and forged responses is identical. In the experiment, finding a collision in MD5 for the attack took 3-6 minutes, which is longer than the typical timeout of 30-60 seconds, but the time to find a collision can be reduced by using more powerful hardware, leveraging GPUs, and parallelizing operations.
As a primary measure to protect against this vulnerability, it is recommended to implement the EAP (Extensible Authentication Protocol, RFC 3579), which uses the Message-Authenticator attribute for additional message verification. To protect against the attack, protocol extensions (RadSec) can also be used, which include transmitting RADIUS messages over encrypted channels based on TLS or DTLS. Furthermore, the response timeout values can be minimized, and responses with the Proxy-State attribute can be blocked. Transmitting RADIUS messages over TCP complicates the attack but does not eliminate the possibility of its execution.
The code for executing the attack has not yet been made public, but the project hashclash has been given updates that improve collision searches in MD5 considering the specifics of the attack. In the FreeRADIUS server, the issue has been resolved in versions 3.0.27 and 3.2.5 by mandating the use of the Message-Authenticator attribute and adding a setting to limit the processing of packets with the Proxy-State attribute.
Source: opennet.ru
