Critical PuTTY vulnerability exposes private keys

Home / Threat Intelligence bulletins / Critical PuTTY vulnerability exposes private keys

Target Industry

Indiscriminate, opportunistic targeting.

Overview

PuTTY is an open-source client software, supports Secure Shell (SSH), Telnet, and various other network protocols. It facilitates connections to distant servers and allows file transfers. A severe security flaw has been identified in the PuTTY client and associated elements, enabling threat actors to completely retrieve NIST P-521 private keys. Tracked as CVE-2024-31497 (CVSSv2 score: 4.3), this vulnerability arises due to the generation of heavily skewed ECDSA nonces by the PuTTY client when utilising the NIST P-521 elliptic curve. This vulnerability impacts versions from 0.68 through 0.80 that could be exploited to achieve full recovery of NIST P-521 (ecdsa-sha2-nistp521) private keys.

Impact

An attacker with access to several dozen signed messages and the public key can gather sufficient information to retrieve the private key. This would enable them to falsify signatures as though they originated from the victim, thereby granting the attacker the ability to gain access to servers that use the same key. Additionally, the attacker can forge data signed with compromised keys, such as git commits.

Vulnerability Detection

PuTTy has released security patches for these vulnerabilities. As such, previous versions are vulnerable to potential exploitation.

Affected Products

It is strongly recommended that users apply the relevant security patches as soon as possible. PuTTY associated products that have been impacted by this vulnerability are:

FileZilla versions 3.24.1 through to 3.66.5
WinSCP versions 5.9.5 through to 6.3.2
TortoiseGit versions 2.4.0.2 through to 2.15.0
TortoiseSVN versions 1.10.0 through to 1.14.6

Containment, Mitigations & Remediations

The vulnerability has been fixed in the latest versions of the affected products:

PuTTY 0.81
FileZilla 3.67.0
WinSCP 6.3.3
TortoiseGit 2.15.1
TortoiseSVN 1.14.7

Indicators of Compromise

No specific Indicators of Compromise (IoCs) are available currently.

Threat Landscape

The PuTTY SSH client holds a substantial portion of the market share when it comes to remote access tools. Given that cybercriminals usually employ a mix of probability and asset value to decide which attack surfaces to concentrate on, the PuTTY SSH client has become a primary target. Considering that remote access tools have become an essential part of both individual and business operations, threat actors will persist in exploiting vulnerabilities within these systems in an effort to extract the sensitive information they hold.