Home / Advisories / KLCERT advisories / KLCERT-20-022: Rockwell Automation ISaGRAF Runtime: Code Execution due to Relative Path Traversal

KLCERT-20-022: Rockwell Automation ISaGRAF Runtime: Code Execution due to Relative Path Traversal

Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.

KLCERT-ID KLCERT-20-022
CVE CVE-2020-25176
CWE CWE-23: Relative Path Traversal
Publication date 2021-07-13
Researcher Alexander Nochvay
Description

Some commands used by the ISaGRAF eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible to traverse the ISaGRAF Runtime application’s directory.

Impact

The vulnerability leads to remote code execution.

Severity
CVSS v3 Base Score 9.1 (Critical)
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploitability ⚠ Remotely exploitable: network access to port 1131/TCP is required
Difficulty ⚠ Low skill level to exploit
Privilege required High privilege level required: an account with “service” privileges is required
User interaction ⚠ No user interaction required
Scope ⚠ Scope changed: it is possible to break out from the application’s folder and access any files on the filesystem with privilege of IXL service
Confidentiality ⚠ Confidentiality of the system may be seriously affected: it is possible to read arbitrary files on the filesystem
Integrity ⚠ Integrity of the system may be seriously affected: it is possible to modify and upload files on the filesystem
Availability ⚠ Availability of the system may be seriously affected: it is possible to remove files on the filesystem
Affected products
Affected products
  • AADvance Controller:
    • All firmware versions before 1.40 inclusive
  • Based on ISaGRAF Runtime 5 controllers:
    • All software versions before 5.72.00
  • Micro800 family:
    • All firmware versions
  • ISaGRAF Free Runtime:
    • All software versions before 5.72.00
Mitigation
Rockwell Automation mitigation

Rockwell Automation recommends upgrading to ISaGRAF Runtime 5 version 5.72.00.

Customers should ensure that the least-privilege user principle is followed, and user/service account access to Runtime’s folder location is granted with a minimum amount of rights as needed.

For ISaGRAF, customers are encouraged to restrict or block traffic on TCP 1131 from outside of the industrial control system network zone. For more information on the TCP/UDP ports used by ISaGRAF refer to product documentation.

For AADvance controllers, customers are encouraged to restrict or block traffic on TCP 1132 from outside of the industrial control system network zone.

For Micro800 family, to reduce risk, customers are encouraged to protect the controller with a password. Additionally, customers deploying Micro870, Micro850, or Micro830 controllers are encouraged to put the controller’s mode switch to “RUN”. Customers are encouraged to restrict or block traffic on TCP 44818 from outside the industrial control system network zone.

Since ISaGRAF 5 Runtime is provided to a customer as a development kit, implementing least-privilege may vary from implementation to implementation based on the hardware in use.

Customers should also confirm they are employing proper network segmentation and security controls. Specifically, network exposure for all control system devices should be minimized, and control systems should be behind firewalls and isolated from other networks when possible.1


  1. For more information on the TCP/UDP ports used by Rockwell Automation products, see BF7490.↩︎

Timeline 2020-02-21 – Vulnerability reported
2020-03-11 – Rockwell Automation confirmed the vulnerability
2021-06-08 – Rockwell Automation published the advisory
2021-06-17 – ICS CERT published the advisory