13 July 2021

KLCERT-20-026: Rockwell Automation ISaGRAF Runtime: Information Disclosure due to cleartext storage of passwords in a file and memory

Researcher

Alexander Nochvay, Kaspersky ICS CERT

Timeline

Timeline

  • Kaspersky ICS CERT advisory updated

    02 November 2023

  • Kaspersky ICS CERT advisory published

    13 July 2021

  • Rockwell Automation published the advisory

    08 June 2021

  • Rockwell Automation confirmed the vulnerability

    11 March 2020

  • Vulnerability reported

    21 February 2020

Description

The affected software stores in plaintext the target-password in process memory and in a file, which is located in VirtualStore folder.

The vulnerability should be ignored since an attacker has to obtained high privileged user. By high privilege attackers perspective, there is no reason to evolve attack on the system through exploitation of the vulnerability.


Exploitability

Locally exploitable

Attack complexity

⚠ Low skill level to exploit: an attacker must perform Man-in-the-Middle attack

Privilege required

Administrative privileges are required: high-privilege level is required to read file in VirtualStore folder of specific user

User interaction

⚠ No user interaction required

Confidentiality

⚠ Confidentiality of the system may be seriously affected

Impact

Confidentiality of the system is seriously affected

Affected products

  • Rockwell Automation ISaGRAF Runtime v5 before 5.72.00
  • Devices based on ISaRAF Runtime Toolkit 5 before 5.72.00
  • AADvance Controller: All firmware versions

Mitigation

Rockwell Automation mitigation

Rockwell Automation recommends upgrading to ISaGRAF Runtime 5 version 5.72.00.

Customers should ensure that the least-privilege user principle is followed, and user/service account access to Runtime’s folder location is granted with a minimum amount of rights as needed.

For ISaGRAF, restrict or block traffic on TCP 1131 from outside of the industrial control system network zone. For more information on the TCP/UDP ports used by ISaGRAF refer to product documentation.

Since ISaGRAF 5 Runtime is provided to a customer as a development kit, implementing least-privilege may vary from implementation to implementation based on the hardware in use.

For AADvance controllers, customers are encouraged to restrict or block traffic on TCP 1132 from outside of the industrial control system network zone.1


  1. For more information on the TCP/UDP ports used by Rockwell Automation products, see BF7490.↩︎

Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.

Timeline

  • Kaspersky ICS CERT advisory updated

    02 November 2023

  • Kaspersky ICS CERT advisory published

    13 July 2021

  • Rockwell Automation published the advisory

    08 June 2021

  • Rockwell Automation confirmed the vulnerability

    11 March 2020

  • Vulnerability reported

    21 February 2020