Message-ID: <420cf200-9f9d-a1ef-7ba5-03ac91b6ffde@sec-consult.com>
Date: Wed, 13 Apr 2022 10:15:24 +0000
From: "SEC Consult Vulnerability Lab,
 Research via Fulldisclosure" <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] SEC Consult SA-20220413 :: Missing Authentication at File
 Download & Denial of Service in Siemens A8000 PLC

SEC Consult Vulnerability Lab Security Advisory < 20220413-0 >
=======================================================================
               title: Missing Authentication at File Download & Denial of Service
             product: Siemens A8000 CP-8050/CP-8031 SICAM WEB
  vulnerable version: < SICAM WEB Version 05.80 / < Firmware Package 04.80
       fixed version: SICAM WEB V05.80 / Firmware Package 04.80
          CVE number: CVE-2022-27480
              impact: Medium
            homepage: https://www.siemens.com
               found: 2021-11-10
                  by: SEC Consult Vulnerability Lab
                      This vulnerability was discovered during the research
                      cooperation initiative "OT Cyber Security Lab" between
                      Verbund AG and SEC Consult Group.
                      Steffen Robertz (Office Vienna)
                      Gerhard Hechenberger (Office Vienna)
                      Thomas Weber (Office Vienna)

                      An integrated part of SEC Consult, an Atos company
                      Europe | Asia | North America

                      https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"We are a technology company focused on industry, infrastructure, transport,
and healthcare. From more resource-efficient factories, resilient
supply chains, and smarter buildings and grids, to cleaner and more comfortable
transportation as well as advanced healthcare, we create technology with
purpose adding real value for customers. By combining the real and the digital
worlds, we empower our customers to transform their industries and markets,
helping them to transform the everyday for billions of people."

Source: https://new.siemens.com/global/en/company/about.html


Business recommendation:
------------------------
Update to the current firmware in order to fix the missing authentication vulnerability.
Siemens will not fix the denial of service vulnerability.

SEC Consult highly recommends to perform a thorough security review of the
product conducted by security professionals to identify and resolve
potential further security issues.


Vulnerability overview/description:
-----------------------------------
1) Missing Authentication at File Download (CVE-2022-27480)
Several files that can be created by an authorized user are placed in the
web server's root directory. The user can then download these files with a
press on a UI button. However, the files are not deleted automatically after
the user downloads them. The filenames are static and the download does not
require any authentication. Therefore, they can be retrieved by anybody later.


2) Denial of Service Condition
The PLC will stop responding to any connection attempts as soon as a light
network load is placed on it. This effectively shuts down the management
interfaces.


Proof of concept:
-----------------
1) Missing Authentication at File Download (CVE-2022-27480)
First, a file has to be created. This is possible by logging into SICAM Web.
As an example, a network traffic capture can be created by navigating to
"Monitoring & Simulation" -> "Ethernet Packet Capture".

The following request shows how another client downloads the resulting
wireshark.zip file without sending any authentication headers.

-----------------------------
GET /wireshark.zip HTTP/1.1
Host: [IP]
-----------------------------

The server responds with the created capture file:
-----------------------------
HTTP/1.1 200 OK
Content-Type: application/zip
Accept-Ranges: bytes
Cache-Control: max-age=0, private
Content-Length: 370
Server: A8000
[...]

PKÚV\S!ÙM>wireshark0.pcap
[...]
------------------------------


2) Denial of Service Condition
Putting a light network load on the PLC's interfaces causes a denial of
service condition. In the tests it was enough to run a directory bruteforce
with 5 threads in order to shut down all management interfaces. After the
scan stopped, it took several minutes for the PLC to come back online.


Vulnerable / tested versions:
-----------------------------
The following product has been tested:
* Siemens A8000 CP-8050 SICAM Web 05.50


Vendor contact timeline:
------------------------
2022-02-07: Contacting vendor through productcert@...mens.com
2022-02-07: Siemens opened ticket, Issue 1 is already known for another product (CVE-2021-45034)
2022-02-09: Provided further information about the PLC version to Siemens
2022-02-10: Information forwarded to developers
2022-02-15: Siemens identified the right model, does not consider DoS as
             valid finding, as it does not stop the control loop from running and it is
             not an edge device
2022-03-22: Siemens asks to move disclosure date to their patch day on April 12th.
             SEC Consult agrees. Siemens now recognizes the DoS condition, but is
             accepting the risk and won't patch.
2022-03-28: Informing Siemens that our advisory will be coordinated with their patch
             day.
2022-04-12: Siemens patch day and Siemens advisory release.
2022-04-13: SEC Consult advisory release.


Solution:
---------
For issue 1: Update to the current firmware, for further information see the advisory from
the vendor:

https://cert-portal.siemens.com/productcert/html/ssa-316850.html


For issue 2: Siemens marked this vulnerability as wont-fix.
The issue will/can not be patched by software. Siemens accepts the risk, as
the control loop keeps running and the device is not an edge device.


Workaround:
-----------
Restrict network access to the A8000 and make sure, that your use-case does
not send traffic exceeding the DoS limitation.


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult, an Atos company
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos company. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Steffen Robertz, Gerhard Hechenberger, Thomas Weber / @2022
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists