Sauter ModuWEB Vision SCADA vulnerabilities

[Martin Jartelius <mj () outpost24 com>]

Vulnerabilities

---------------

CVSS 10 - INSECURE CREDENTIAL STORAGE (Pass the Hash) CVE-2015-7914

CVSS 10 - INSECURE TRANSMISSION OF CREDENTIALS CVE-2015-7915

CVSS 7.4 - CROSS-SITE SCRIPTING CVE-2015-7916

 

Other risk exposures

---------------

Undocumented default accounts

 

Note that default accounts with changeable passwords, even when those
are undocumented and do not look as user accounts neither in interface
or documentation, constitute a formal vulnerability. It is at worst a
misconfiguration.

 

References (Source)

---------------

This advisory:

https://www.outpost24.com/critical-scada-vulnerabilities-sauter-moduweb/

 

ICS CERT:

https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01


Summary of the issues
---------------
In short – By obtaining access to a system using undocumented accounts,
it is possible to obtain a low privilege level.

By exploiting the fact that the cashed credentials used for the
“remember me” function of the web application employ the same encryption
as the one used for protection of passwords included in backups, a user
can elevate privileges to administrator level.

The backups also contain other encrypted configuration information which
can further an attacker’s access to also affect for example email
accounts used for notifications.

By accessing the system as an administrator, an attacker can obtain
those credentials in plain text from the system as they are included in
the configuration details, protected only by the use of “password”
field-types in the forms.

In essence this constitute a pass the hash vulnerability. Just as with
https://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/
which used hashed inputs to generate secure transfer of credentials over
non encrypted connections, applying the same protection scheme to its
stored, and exposed, secrets.


Don’t do your own cryptography.

 

A bit more details, sufficient for the interested reader to recreate but
not a straight forward guide, available at the provided references.

 

 

Martin Jartelius – CSO – Outpost24
John Stock – Technology Program Director – Outpost24


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/