SYT-2023-2: Bypass of limitations and relative path transversal vulnerability in OPC UA C++ SDK and Secure Integration Server
| Publisher: Softing Industrial Automation GmbH |
Document category: csaf_security_advisory |
| Initial release date: 2023-05-06T07:00:00.000Z |
Engine: Secvisogram .2.2.15 |
| Current release date: 2023-11-29T12:06:44.535Z |
Build Date: 2023-11-29T12:06:44.535Z |
| Current version: 2.0.0 |
Status: final |
| CVSSv3.1 Base Score: 7.7 |
Severity:
high
|
| Original language: en-US |
Language: |
| Also referred to: |
Vulnerabilities
(CVE-2023-29377)
The OPC UA file object implementation allows to bypass the separation between OPC UA namespaces, limitations on assignment of directory path to FileDirectory OPC UA objects and limitations on assignment of the file path to File OPC UA objects.
In combination with CVE-2023-29378 the server gives read and write access to local files which could be used for remote code excecution.
| CWE: |
CWE-22:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| Discovery date: |
2022-10-14T10:00:00.000Z |
Product status
Known affected
| Product |
CVSS-Vector |
CVSS Base Score |
| Softing OPC UA C++ SDK <= 6.20 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L |
7.7 |
| Softing Secure Integration Server <= V1.22 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L |
7.7 |
Fixed
- Softing OPC UA C++ SDK V6.20.1
- Softing Secure Integration Server V1.30
Acknowledgments
- Claroty Team82 working with Trend Micro Zero Day Initiative
(CVE-2023-29378)
The OPC UA FileDirectory and File object implementation does not check for relative path traversal.
In combination with CVE-2023-29377 the server gives read and write access to local files which could be used for remote code excecution.
| CWE: |
CWE-23:Relative Path Traversal |
Product status
Known affected
| Product |
CVSS-Vector |
CVSS Base Score |
| Softing OPC UA C++ SDK <= 6.20 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L |
7.7 |
| Softing Secure Integration Server <= V1.22 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L |
7.7 |
Fixed
- Softing OPC UA C++ SDK V6.20.1
- Softing Secure Integration Server V1.30
Acknowledgments
- Claroty Team82 working with Trend Micro Zero Day Initiative
Softing Industrial Automation GmbH
Namespace: https://industrial.softing.com
Softing PSIRT - contact us at [email protected]
Revision history
| Version |
Date of the revision |
Summary of the revision |
| 1.0.0 |
2023-06-05T07:00:00.000Z |
Initial version |
| 2.0.0 |
2023-11-29T12:06:44.535Z |
Fix for Secure Integration Server |
Disclaimer
The information provided in this disclosure is provided "as is" without warranty of any kind.
Softing disclaims all warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose. In no event shall Softing or its suppliers be
liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of
business profits or special damages, even if Softing or its suppliers have been advised of the
possibility of such damages.
Some states do not allow the exclusion or limitation of liability for consequential or incidental
damages so the foregoing limitation may not apply.