KLCERT-18-025: General Electric Proficy GDS XML eXternal Entity (XXE)

Main
Advisories
KLCERT-18-025: General Electric Proficy GDS XML eXternal Entity (XXE)

07 December 2018

Vendor

General Electric

CVE-IDS

2018-15362
KLCERT

KLCERT-18-025

Timeline

Kaspersky ICS CERT advisory published

07 December 2018
The vendor releases a patch

December 2018
The vendor has stopped replying regarding this issue. The problem is escalated to US ICS-CERT

January 2018

Description

An XXE injection vulnerability leads to path traversal inside the Proficy server. An attacker may be able to initiate an OPC UA session and retrieve an arbitrary file from the target system.

CVSS v3

0.0

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)

Exploitability

Remotely

Attack complexity

Low

User interaction

None

Impact

Successful exploitation of this vulnerability could allow an attacker to initiate an OPC UA session and retrieve an arbitrary file.

Existence of exploit

Unknown

Affected products

Cimplicity 9.0 R2,
Cimplicity 9.5, and
Cimplicity 10.0

Mitigation

Vendor mitigation

GE recommends users update to Version 2.1 or newer. The fixed version is available at the following link: https://ge-ip.flexnetoperations.com/control/geip/download?element=10544807 (Login required)

Kaspersky Lab publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky Lab does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.

Timeline

Kaspersky ICS CERT advisory published

07 December 2018
The vendor releases a patch

December 2018
The vendor has stopped replying regarding this issue. The problem is escalated to US ICS-CERT

January 2018