SEC Consult Vulnerability Lab Security Advisory < 20220413-0 > ======================================================================= title: Missing Authentication at File Download & Denial of Service product: Siemens A8000 CP-8050/CP-8031 SICAM WEB vulnerable version: < SICAM WEB Version 05.80 / < Firmware Package 04.80 fixed version: SICAM WEB V05.80 / Firmware Package 04.80 CVE number: CVE-2022-27480 impact: Medium homepage: https://www.siemens.com found: 2021-11-10 by: SEC Consult Vulnerability Lab This vulnerability was discovered during the research cooperation initiative "OT Cyber Security Lab" between Verbund AG and SEC Consult Group. Steffen Robertz (Office Vienna) Gerhard Hechenberger (Office Vienna) Thomas Weber (Office Vienna) An integrated part of SEC Consult, an Atos company Europe | Asia | North America https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "We are a technology company focused on industry, infrastructure, transport, and healthcare. From more resource-efficient factories, resilient supply chains, and smarter buildings and grids, to cleaner and more comfortable transportation as well as advanced healthcare, we create technology with purpose adding real value for customers. By combining the real and the digital worlds, we empower our customers to transform their industries and markets, helping them to transform the everyday for billions of people." Source: https://new.siemens.com/global/en/company/about.html Business recommendation: ------------------------ Update to the current firmware in order to fix the missing authentication vulnerability. Siemens will not fix the denial of service vulnerability. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Missing Authentication at File Download (CVE-2022-27480) Several files that can be created by an authorized user are placed in the web server's root directory. The user can then download these files with a press on a UI button. However, the files are not deleted automatically after the user downloads them. The filenames are static and the download does not require any authentication. Therefore, they can be retrieved by anybody later. 2) Denial of Service Condition The PLC will stop responding to any connection attempts as soon as a light network load is placed on it. This effectively shuts down the management interfaces. Proof of concept: ----------------- 1) Missing Authentication at File Download (CVE-2022-27480) First, a file has to be created. This is possible by logging into SICAM Web. As an example, a network traffic capture can be created by navigating to "Monitoring & Simulation" -> "Ethernet Packet Capture". The following request shows how another client downloads the resulting wireshark.zip file without sending any authentication headers. ----------------------------- GET /wireshark.zip HTTP/1.1 Host: [IP] ----------------------------- The server responds with the created capture file: ----------------------------- HTTP/1.1 200 OK Content-Type: application/zip Accept-Ranges: bytes Cache-Control: max-age=0, private Content-Length: 370 Server: A8000 [...] PKÚV\S!ÙM>wireshark0.pcap [...] ------------------------------ 2) Denial of Service Condition Putting a light network load on the PLC's interfaces causes a denial of service condition. In the tests it was enough to run a directory bruteforce with 5 threads in order to shut down all management interfaces. After the scan stopped, it took several minutes for the PLC to come back online. Vulnerable / tested versions: ----------------------------- The following product has been tested: * Siemens A8000 CP-8050 SICAM Web 05.50 Vendor contact timeline: ------------------------ 2022-02-07: Contacting vendor through productcert@siemens.com 2022-02-07: Siemens opened ticket, Issue 1 is already known for another product (CVE-2021-45034) 2022-02-09: Provided further information about the PLC version to Siemens 2022-02-10: Information forwarded to developers 2022-02-15: Siemens identified the right model, does not consider DoS as valid finding, as it does not stop the control loop from running and it is not an edge device 2022-03-22: Siemens asks to move disclosure date to their patch day on April 12th. SEC Consult agrees. Siemens now recognizes the DoS condition, but is accepting the risk and won't patch. 2022-03-28: Informing Siemens that our advisory will be coordinated with their patch day. 2022-04-12: Siemens patch day and Siemens advisory release. 2022-04-13: SEC Consult advisory release. Solution: --------- For issue 1: Update to the current firmware, for further information see the advisory from the vendor: https://cert-portal.siemens.com/productcert/html/ssa-316850.html For issue 2: Siemens marked this vulnerability as wont-fix. The issue will/can not be patched by software. Siemens accepts the risk, as the control loop keeps running and the device is not an edge device. Workaround: ----------- Restrict network access to the A8000 and make sure, that your use-case does not send traffic exceeding the DoS limitation. Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult, an Atos company Europe | Asia | North America About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Atos company. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF Steffen Robertz, Gerhard Hechenberger, Thomas Weber / @2022