Missing Authentication at File Download & Denial of Service in Siemens A8000

Title

Missing Authentication at File Download & Denial of Service

Product

Siemens A8000 CP-8050/CP-8031 SICAM WEB

Vulnerable Version

< SICAM WEB Version 05.80 / < Firmware Package 04.80

Fixed Version

SICAM WEB V05.80 / Firmware Package 04.80

CVE Number

CVE-2022-27480

Impact

medium

Homepage

https://www.siemens.com

Found

10.11.2021

By

Steffen Robertz, Gerhard Hechenberger, Thomas Weber (Office Vienna)

This vulnerability was discovered during the research cooperation initiative "OT Cyber Security Lab" between Verbund AG and SEC Consult Group.

The Siemens A8000 PLC is affected by a missing authentication vulnerability. This allows an unauthenticated user to download e.g. traffic dump files. Furthermore, the PLC's admin interface can become unavailable by sending a moderate amount of network traffic (denial of service).

Vendor description

"We are a technology company focused on industry, infrastructure, transport,  and healthcare. From more resource-efficient factories, resilient  supply chains, and smarter buildings and grids, to cleaner and more comfortable transportation as well as advanced healthcare, we create technology with  purpose adding real value for customers. By combining the real and the digital worlds, we empower our customers to transform their industries and markets,  helping them to transform the everyday for billions of people."

Source: new.siemens.com/global/en/company/about.html


Business recommendation

Update to the current firmware in order to fix the missing authentication vulnerability. Siemens will not fix the denial of service vulnerability.

SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.


Vulnerability overview/description

1) Missing Authentication at File Download (CVE-2022-27480)

Several files that can be created by an authorized user are placed in the web server's root directory. The user can then download these files with a press on a UI button. However, the files are not deleted automatically after the user downloads them. The filenames are static and the download does not require any authentication. Therefore, they can be retrieved by anybody later.

2) Denial of Service Condition

The PLC will stop responding to any connection attempts as soon as a light network load is placed on it. This effectively shuts down the management  interfaces.

 

Proof of concept

1) Missing Authentication at File Download (CVE-2022-27480)

First, a file has to be created. This is possible by logging into SICAM Web.  As an example, a network traffic capture can be created by navigating to  "Monitoring & Simulation" -> "Ethernet Packet Capture".  The following request shows how another client downloads the resulting  wireshark.zip file without sending any authentication headers.

GET /wireshark.zip HTTP/1.1
Host: [IP]

The server responds with the created capture file:

HTTP/1.1 200 OK
Content-Type: application/zip
Accept-Ranges: bytes
Cache-Control: max-age=0, private
Content-Length: 370
Server: A8000
[...]

PKÚV\S!ÙM>wireshark0.pcap
[...]

2) Denial of Service Condition

Putting a light network load on the PLC's interfaces causes a denial of  service condition. In the tests it was enough to run a directory bruteforce with 5 threads in order to shut down all management interfaces. After the scan stopped, it took several minutes for the PLC to come back online.

 

Vulnerable / tested versions

The following product has been tested:

  • Siemens A8000 CP-8050 SICAM Web 05.50

Vendor contact timeline

2022-02-07 Contacting vendor through productcert@siemens.com
2022-02-07 Siemens opened ticket, Issue 1 is already known for another product (CVE-2021-45034)
2022-02-09 Provided further information about the PLC version to Siemens
2022-02-10 Information forwarded to developers
2022-02-15 Siemens identified the right model, does not consider DoS as valid finding, as it does not stop the control loop from running and it is not an edge device
2022-03-22 Siemens asks to move disclosure date to their patch day on April 12th. SEC Consult agrees. Siemens now recognizes the DoS condition, but is accepting the risk and won't patch.
2022-03-28 Informing Siemens that our advisory will be coordinated with their patch day.
2022-04-12 Siemens patch day and Siemens advisory release.
2022-04-13 SEC Consult advisory release.

Solution

For issue 1: Update to the current firmware, for further information see the advisory from the vendor:

https://cert-portal.siemens.com/productcert/html/ssa-316850.html

 

For issue 2: Siemens marked this vulnerability as wont-fix. The issue will/can not be patched by software. Siemens accepts the risk, as the control loop keeps running and the device is not an edge device.

Workaround

Restrict network access to the A8000 and make sure, that your use-case does not send traffic exceeding the DoS limitation.

 

Advisory URL

sec-consult.com/vulnerability-lab/

 

EOF Steffen Robertz, Gerhard Hechenberger, Thomas Weber / @2022

 

 

Interested in working with the experts of SEC Consult? Send us your application.

Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices.

Back