CVE-2024-54143

The request hashing mechanism truncates SHA-256 hashes to only 12 characters, making hash collision generation practically feasible. An attacker can pre-build a malicious image that obtains the same truncated hash as a legitimate image, then swap it in the artifact cache (cache poisoning). Additionally, the command injection vulnerability in the Imagebuilder component allows a malicious user to inject arbitrary commands into the image build process. The end result is the production and distribution of compromised firmware signed with an authentic build key, making the malicious image appear fully legitimate.

An attacker can deliver malicious firmware images to users signed with a legitimate build key, leading to complete takeover of devices updating through the ASU server. Confidentiality, integrity, and availability of infected network devices may be compromised.

Update openwrt/asu to a version containing patch 920c8a13d97b4d4095f0d939cf0aaae777e0f87e available in the project's GitHub repository. Details available in security advisory GHSA-r3gq-96h6-3v7q.

The openwrt/asu server (Image on Demand Server for OpenWrt-based distributions) in all versions before commit 920c8a1.