Home / Advisories / KLCERT advisories / KLCERT-20-024: Rockwell Automation ISaGRAF Runtime: Code Execution due to Uncontrolled Search Path Element

KLCERT-20-024: Rockwell Automation ISaGRAF Runtime: Code Execution due to Uncontrolled Search Path Element

Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.

KLCERT-ID KLCERT-20-024
CVE CVE-2020-25182
CWE CWE-427: Uncontrolled Search Path Element
Publication date 2021-07-13
Researcher Alexander Nochvay
Description

ISaGRAF Runtime for Microsoft Windows searches its directory for all files that have extension “.dll” and loads them as dynamic libraries.

Impact

Uncontrolled loading of dynamic libraries could allow a local attacker to execute arbitrary code.

Severity
CVSS v3 Base Score 6.7 (Medium)
Vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability Locally exploitable
Difficulty ⚠ Low skill level to exploit
Privilege required High privilege level required: high-privilege level is required to create files in %PROGRAMFILES% directory
User interaction ⚠ No user interaction required
Confidentiality ⚠ Confidentiality of the system may be seriously affected
Integrity ⚠ Integrity of the system may be seriously affected
Availability ⚠ Availability of the system may be seriously affected
Affected products
Affected products
  • Based on ISaGRAF Runtime 5 controllers:
    • All software versions
  • ISaGRAF Free Runtime:
    • All software versions
Mitigation
Rockwell Automation mitigation

Rockwell Automation recommends upgrading to ISaGRAF Runtime 5 version 5.72.00.

Since ISaGRAF 5 Runtime is provided to a customer as a development kit, implementing least-privilege may vary from implementation to implementation based on the hardware in use.

Customers should ensure that the least-privilege user principle is followed, and user/service account access to Runtime’s folder location is granted with a minimum amount of rights as needed.

Timeline 2020-02-21 – Vulnerability reported
2020-03-11 – Rockwell Automation confirmed the vulnerability
2021-06-08 – Rockwell Automation published the advisory
2021-06-17 – ICS CERT published the advisory