Control System Defense: Know the Opponent

September 22, 2022Elle CeeDee

Cybersecurity
US-CERTUS-CERThttps://us-cert.cisa.gov/node/17997Control System Defense: Know the Opponent/ncas/alerts/aa22-265aThu, 22 Sep 2022 08:55:58 EDT
Control System Defense: Know the Opponent

Schedule Demo: Managed IT

Use Our Online Scheduling Tool

Progress Software has released a security advisory  for a vulnerability in MOVEit Transfer—a Managed File Transfer Software . A cyber threat actor could exploit this vulnerability to take over an affected system. CISA urgers users and organizations to review the MOVEit Transfer Advisory , follow the mitigation steps, apply the necessary updates, and hunt for any malicious activity.CISAraw:200cd790c45f228158b27dddebf46970 – 2023-06-01T19:45:35.000Z
Read More →
1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION:  Exploitable remotely/low attack complexity Vendor:  HID Global Equipment:  SAFE Vulnerabilities:  Modification of Assumed-Immutable Data 2. RISK EVALUATION Successful exploitation of this vulnerability could result in exposure of personal data or create a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of HID’s SAFE, a personnel and access management software, are affected: HID SAFE using the optional External Visitor Manager portal: Versions 5.8.0 through 5.11.3 3.2 VULNERABILITY OVERVIEW 3.2.1 MODIFICATION OF ASSUMED-IMMUTABLE DATA CWE-471 The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request generated by an internal user and then manipulate the visitor-id within the web API to access the personal data of other users. There is no limit on the number of requests that can be made to the HID SAFE Web Server, so an attacker could also exploit this vulnerability to create a denial-of-service condition. CVE-2023-2904 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H ). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS:  Government Facilities, Transportation, Commercial Facilities, Healthcare COUNTRIES/AREAS DEPLOYED:  Worldwide COMPANY HEADQUARTERS LOCATION:  United States 3.4 RESEARCHER CISA internal research reported this vulnerability to HID. 4. MITIGATIONS The External Visitor Management feature is licensed and deployed separately from the HID SAFE core software. Users not using this feature are not affected. According to HID Global, the number of affected systems is limited and all affected systems have been patched. Please see HID’s security advisory for more information. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploits specifically target this vulnerability.CISAraw:105ba3c41cb4240ed654564ea4a82026 – 2023-06-01T15:21:07.000Z
Read More →
1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION:  Exploitable remotely/low attack complexity Vendor:  Advantech Equipment:  WebAccess Node Vulnerabilities:  Improper Control of Generation of Code (‘Code Injection’), Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to arbitrarily overwrite files resulting in remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Advantech products are affected: WebAccess/SCADA versions 9.1.3 and prior 3.2 VULNERABILITY OVERVIEW 3.2.1  IMPROPER CONTROL OF GENERATION OF CODE (‘CODE INJECTION’) CWE-94 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution. CVE-2023-32540 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H ). 3.2.2 UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code execution. CVE-2023-22450 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H ). 3.2.3 UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution. CVE-2023-32628 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H ). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS:  Critical Manufacturing, Energy, Water and Wastewater Systems COUNTRIES/AREAS DEPLOYED:  East Asia, Europe, United States COMPANY HEADQUARTERS LOCATION:  Tawain 3.4 RESEARCHER YangLiu from Elex Feigong Research Institute reported these vulnerabilities to CISA. 4. MITIGATIONS Advantech recommends WebAccess/SCADA users upgrade to v9.1.4 . CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should: Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet . Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.CISAraw:81f9e153a531c78ba267303e2f945bee – 2023-06-01T15:21:06.000Z
Read More →