13 июля 2021

KLCERT-20-024: Rockwell Automation ISaGRAF Runtime: Code Execution due to Uncontrolled Search Path Element

Vendor

Rockwell Automation

Researcher

Alexander Nochvay, Kaspersky ICS CERT

Timeline

Timeline

  • Kaspersky ICS CERT advisory updated

    15 ноября 2023

  • Kaspersky ICS CERT advisory published

    13 июля 2021

  • Rockwell Automation published the advisory

    08 июня 2021

  • Rockwell Automation confirmed the vulnerability

    11 марта 2020

  • Vulnerability reported

    21 февраля 2020

Description

An attacker with write privileges in VirtualStore folder can perform arbitrary code execution by placing ".dll" files in affected software directory, because the software loads dynamic libraries in an uncontrolled way.

CWE

CWE-427: Uncontrolled Search Path Element

CVSS v3

0.0

 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

Exploitability

Locally exploitable

Attack complexity

⚠ Low skill level to exploit

Privilege required

Administrative privileges are required: high-privilege level is required to create files in VirtualStore folder of specific user

User interaction

User interaction is required: it is required to restart the application "ISaVM.exe" or "ISaGRAF.exe" by user

Confidentiality

⚠ Confidentiality of the system may be seriously affected

Impact

Uncontrolled loading of dynamic libraries could allow a local attacker to execute arbitrary code.

Affected products

  • Rockwell Automation ISaGRAF Runtime v5 before 5.72.00
  • Devices based on ISaRAF Runtime Toolkit 5 before 5.72.00

Mitigation

Rockwell Automation mitigation

Rockwell Automation recommends upgrading to ISaGRAF Runtime 5 version 5.72.00.

Since ISaGRAF 5 Runtime is provided to a customer as a development kit, implementing least-privilege may vary from implementation to implementation based on the hardware in use.

Customers should ensure that the least-privilege user principle is followed, and user/service account access to Runtime’s folder location is granted with a minimum amount of rights as needed.

Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.

Вернуться к началу

Timeline

  • Kaspersky ICS CERT advisory updated

    15 ноября 2023

  • Kaspersky ICS CERT advisory published

    13 июля 2021

  • Rockwell Automation published the advisory

    08 июня 2021

  • Rockwell Automation confirmed the vulnerability

    11 марта 2020

  • Vulnerability reported

    21 февраля 2020

Вернуться к началу
Подписка на рассылку