SYT-2023-9: Multiple vulnerabilities in edgeConnector, edgeAggregator and Secure Integration Server
| Publisher: Softing Industrial Automation GmbH |
Document category: csaf_security_advisory |
| Initial release date: 2023-12-01T06:22:12.316Z |
Engine: Secvisogram .2.2.15 |
| Current release date: 2023-12-01T06:22:12.316Z |
Build Date: 2023-12-01T06:22:12.316Z |
| Current version: 1.0.0 |
Status: final |
| CVSSv3.1 Base Score: 7.2 |
Severity:
high
|
| Original language: en-US |
Language: |
| Also referred to: |
Vulnerabilities
(CVE-2023-27335)
The test OPC UA server connection functionality allows to perform Javascript code provided by an OPC UA server.
| CWE: |
CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| Discovery date: |
2023-02-15T10:00:00.000Z |
Product status
Known affected
| Product |
CVSS-Vector |
CVSS Base Score |
| Softing edgeAggregator <= V3.60 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
6.6 |
| Softing Secure Integration Server <= V1.22 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
6.6 |
Fixed
- Softing edgeAggregator V3.70
- Softing Secure Integration Server V1.30
Acknowledgments
- Claroty Team82 working with Trend Micro Zero Day Initiative
(CVE-2023-38125)
The server allows to fetch and execute remote Javascript scripts because of the lack of CSP headers in the web server.
| CWE: |
CWE-942:Permissive Cross-domain Policy with Untrusted Domains |
Product status
Known affected
| Product |
CVSS-Vector |
CVSS Base Score |
| Softing edgeConnector <= V3.40 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
7.2 |
| Softing edgeAggregator <= V3.40 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
7.2 |
| Softing Secure Integration Server <= V1.22 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
7.2 |
Fixed
- Softing edgeConnector V3.50
- Softing edgeAggregator V3.50
- Softing Secure Integration Server V1.30
Acknowledgments
- Claroty Team82 working with Trend Micro Zero Day Initiative
(CVE-2023-38126)
Directory traversal vulnerability when unzipping a configuration zip in `/runtime/core/config-restore`, allowing the attacker to write a file anywhere within the filesystem. By overwriting a legitimate executable in `/bin` or `/lib`, the attacker can gain arbitrary code execution as root on the appliance.
| CWE: |
CWE-22:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
Product status
Known affected
| Product |
CVSS-Vector |
CVSS Base Score |
| Softing edgeConnector <= V3.60 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
7.2 |
| Softing edgeAggregator <= V3.60 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
7.2 |
| Softing Secure Integration Server <= V1.22 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
7.2 |
Fixed
- Softing edgeConnector V3.70
- Softing edgeAggregator V3.70
- Softing Secure Integration Server V1.30
Acknowledgments
- Claroty Team82 working with Trend Micro Zero Day Initiative
- Pan ZhenPeng, Li JianTao from STAR Labs SG Pte. Ltd. for Trend Micro Zero Day Initiative
Softing Industrial Automation GmbH
Namespace: https://industrial.softing.com
Softing PSIRT - contact us at [email protected]
Revision history
| Version |
Date of the revision |
Summary of the revision |
| 1.0.0 |
2023-12-01T06:22:12.316Z |
Initial version |
Disclaimer
The information provided in this disclosure is provided "as is" without warranty of any kind.
Softing disclaims all warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose. In no event shall Softing or its suppliers be
liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of
business profits or special damages, even if Softing or its suppliers have been advised of the
possibility of such damages.
Some states do not allow the exclusion or limitation of liability for consequential or incidental
damages so the foregoing limitation may not apply.