Stormshield Network Security TPM Authentication Information Leak Vulnerability

A vulnerability exists in Stormshield Network Security (SNS) versions prior to 5.0.1, where TPM authentication information could be inadvertently shared among administrators in certain high availability (HA) scenarios. This sharing could lead to unauthorized secret sharing. The issue arises when verbose logging is enabled, which is not the default setting. In such cases, sensitive authentication details may be exposed through system files.

Impact

The vulnerability allows for a low-severity information leak of TPM authentication details between administrators, which could lead to unauthorized sharing of secrets.

Remediation

To address this vulnerability, administrators can update to SNS versions 4.3.40, 4.8.12, or 5.0.1. If an immediate update is not possible, verbose logging can be disabled in the ConfigFiles/serverd file to prevent the information leak.