full-disclosure - [FD] Sauter ModuWEB Vision SCADA vulnerabilities

Open Source and information security mailing list archives

Message-ID: <56B213BB.2040507@outpost24.com>
Date: Wed, 3 Feb 2016 15:50:35 +0100
From: Martin Jartelius <mj@...post24.com>
To: fulldisclosure@...lists.org, moderators@...db.org,
 bugtraq@...urityfocus.com
Subject: [FD] Sauter ModuWEB Vision SCADA vulnerabilities

Vulnerabilities

---------------

CVSS 10 - INSECURE CREDENTIAL STORAGE (Pass the Hash) CVE-2015-7914

CVSS 10 - INSECURE TRANSMISSION OF CREDENTIALS CVE-2015-7915

CVSS 7.4 - CROSS-SITE SCRIPTING CVE-2015-7916

Other risk exposures

---------------

Undocumented default accounts

Note that default accounts with changeable passwords, even when those
are undocumented and do not look as user accounts neither in interface
or documentation, constitute a formal vulnerability. It is at worst a
misconfiguration.

References (Source)

---------------

This advisory:

https://www.outpost24.com/critical-scada-vulnerabilities-sauter-moduweb/

ICS CERT:

https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01

Summary of the issues
---------------
In short – By obtaining access to a system using undocumented accounts,
it is possible to obtain a low privilege level.

By exploiting the fact that the cashed credentials used for the
“remember me” function of the web application employ the same encryption
as the one used for protection of passwords included in backups, a user
can elevate privileges to administrator level.

The backups also contain other encrypted configuration information which
can further an attacker’s access to also affect for example email
accounts used for notifications.

By accessing the system as an administrator, an attacker can obtain
those credentials in plain text from the system as they are included in
the configuration details, protected only by the use of “password”
field-types in the forms.

In essence this constitute a pass the hash vulnerability. Just as with
https://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/
which used hashed inputs to generate secure transfer of credentials over
non encrypted connections, applying the same protection scheme to its
stored, and exposed, secrets.

Don’t do your own cryptography.

A bit more details, sufficient for the interested reader to recreate but
not a straight forward guide, available at the provided references.

Martin Jartelius – CSO – Outpost24
John Stock – Technology Program Director – Outpost24

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives