^{CVE-2024-6400:}Finrota Netahsilat suffers a cleartext storage vulnerability that can allow retrieval of embedded sensitive data, including usernames and passwords.

A cleartext storage vulnerability in Finrota Netahsilat enables an attacker to retrieve embedded sensitive information such as usernames and passwords. The issue is exploitable over the network with low attack complexity and requires low privileges, with user interaction considered active. The vulnerability has a CVSS v4.0 base score of 8.2 (HIGH), indicating a significant impact on confidentiality. It is associated with CAPEC-37 (Retrieve Embedded Sensitive Data), as well as CAPEC-115 (Authentication Bypass), CAPEC-183 (IMAP/SMTP Command Injection), and CAPEC-150 (Collect Data from Common Resource Locations). Fixes have been released in Finrota Netahsilat versions 1.21.10, 1.23.01, 1.23.08, 1.23.11, and 1.24.03, and upgrading to one of these or later mitigates the vulnerability.

Overview

The vulnerability in Finrota Netahsilat results from cleartext storage of sensitive information, enabling an attacker to retrieve credentials embedded in the application or storage layers. It carries a high confidentiality impact and is accessible over network vectors with low attack complexity, requiring only low privileges and some user interaction. The issue is documented with multiple CAPEC mappings and has been addressed in several fixed releases, with the latest remediation available in version 1.24.03 or later.

Remediation

• Upgrade Finrota Netahsilat to a fixed version (preferably 1.24.03 or later) to eliminate the vulnerability.
• If immediate upgrade is not possible, implement compensating controls:
  • Ensure all sensitive data at rest is encrypted using strong algorithms and proper key management (e.g., AES-256 with secure key storage).
  • Remove or prevent any cleartext storage of credentials; verify that usernames, passwords, and other secrets are never stored in plaintext.
  • Store encryption keys in a dedicated, access-controlled key management system; rotate keys as appropriate.
  • Review and tighten access controls to limit who can access storage locations containing credentials.
  • Ensure secure logging and monitoring to detect unauthorized access attempts.
  • Rotate existing credentials if exposure is suspected and enforce strong password policies.
• After applying fixes, validate the remediation by functional testing or vulnerability scanning to confirm credentials are no longer retrievable and that sensitive data is properly protected.
• Consider additional hardening: enforce encryption in transit (TLS), minimize data retention of credentials, and conduct a security review of storage practices.

References

• CVE-2024-6400 — MITRE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6400
• TR-CERT Advisory TR-24-1611: https://www.usom.gov.tr/bildirim/tr-24-1611
• NVD Entry for CVE-2024-6400: https://nvd.nist.gov/vuln/detail/CVE-2024-6400