OpenWrt, the open-source Wi-Fi router project, has urged users to upgrade their images to the same version to mitigate a potential supply chain attack. The issue, discovered last week, stems from vulnerabilities in the project’s attended sysupgrade server (ASU).
Details of the Vulnerability
Paul Spooren, an OpenWrt developer, alerted users via email about a security flaw in the ASU service. The issue was first reported by Ry0taK, a security researcher from Flatt Security, two days prior. Spooren explained: "Due to the combination of the command injection in the 'openwrt/imagebuilder' image and the truncated SHA-256 hash included in the build request hash, an attacker can pollute the legitimate image by providing a package list that causes the hash collision."
- Command Injection: A flaw in Imagebuilder caused by improper sanitization of user-supplied package names allows attackers to create malicious firmware signed with legitimate keys.
- Weak Hash Vulnerability (CWE-328): Tracked as CVE-2024-54143 with a 9.3 CVSS severity rating, the truncation of the SHA-256 hash to 12 characters enables attackers to generate hash collisions.
- Official images and custom images from version 24.10.0-rc2 onward were unaffected.
- Build logs for older custom images were reviewed, though logs older than seven days were excluded due to cleanup policies.