Team82 recently discovered three new Windows-based vulnerabilities in B&R Automation Studio, an integrated industrial automation software environment that supports a wide range of operational technology (OT) functions, including controls, human machine interfaces (HMIs), and safety. B&R Automation Studio is used globally, particularly among chemical, energy, and critical manufacturing companies.
The discovered vulnerabilities relate specifically to the product's update service, require a low level of skill to exploit, and can be leveraged through remote code execution. After being notified by Claroty, B&R Automation issued patches for these vulnerabilities, as well as a US-CERT advisory.
B&R Automation says it has not found evidence indicating any of the vulnerabilities discovered by Claroty have been used maliciously. That being said, Preminger and Anikster's findings provide an illustrative example of how an attacker can leverage software vulnerabilities to exploit computers used for engineering work within an OT environment.
The specific nature of the vulnerabilities uncovered by Claroty are as follows:
Improper privilege management (CVE-2019-19100): This privilege escalation vulnerability could allow authenticated users to delete arbitrary files via an exposed interface.
Missing required cryptographic step (CVE-2019-19101): This missing security communication definition, which leads to incomplete TLS encryption and validation, can enable unauthenticated users to perform man-in-the middle (MITM) attacks via the B&R upgrade server.
Path traversal (CVE-2019-19102): This directory traversal vulnerability in SharpZipLib, also known as a "zip slip," allows unauthenticated users to write to certain local directories.
According to Preminger, an attacker could combine the missing required cryptographic step with the path traversal vulnerability to intervene during a software update, conduct a MITM attack, and install their own malicious code within a victim's network. Leveraging these vulnerabilities, a threat actor could conduct a DNS cache poisoning attack against computers within an OT network while posing as the B&R update server to avoid detection.
In a DNS cache poisoning attack, also known as DNS spoofing, an adversary diverts traffic to a malicious destination while altering DNS records to create the impression of normal, legitimate activity. "This attack is based on hijacking a domain, which becomes much easier if the attacker has gained access to a closed ICS network," Preminger explained in a recent interview with SecurityWeek. "Often, there are no DNS servers to respond to the client. Windows will fallback to local discovery protocols, which are easier to deceive."
B&R Automation recommends applying product updates at the earliest convenience and has provided several workaround mitigations for users unable to upgrade immediately.
To learn more about how Claroty can help your team discover and mitigate vulnerabilities within your OT environment, request a demo.
CWE-257: Storing Passwords in a Recoverable Format
RND encrypts passwords with a hardcoded weak secret key and returns the passwords in plaintext. If the server were compromised, an attacker could gain all the plaintext passwords and decrypt them.
No patches have been supplied by the vendor at this time. To mitigate risk, network administrators should limit access to the wireless management environments that use these affected products, allowing a limited set of trusted users and their authenticated clients to manage Ruckus infrastructure via a secure protocol such as HTTPS or SSH.
CVSS v3: 5.3
CWE-321: Use of Hard-coded Cryptographic Key
A built-in user called sshuser, with root privileges, exists on the RND platform. Both public and private ssh keys exist in the sshuser home directory. Anyone with the private key can access an RND server as sshuser.
No patches have been supplied by the vendor at this time. To mitigate risk, network administrators should limit access to the wireless management environments that use these affected products, allowing a limited set of trusted users and their authenticated clients to manage Ruckus infrastructure via a secure protocol such as HTTPS or SSH.
CVSS v3: 10.0
CWE-259: Use of Hard-coded Password
RND includes a jailed environment to allow users to configure devices without complete shell access to the underlying operating system. The jailed environment includes a built-in jailbreak for technicians to elevate privileges. The jailbreak requires a weak password that is hardcoded into the environment. Anyone with this password can access an RND server with root permissions.
No patches have been supplied by the vendor at this time. To mitigate risk, network administrators should limit access to the wireless management environments that use these affected products, allowing a limited set of trusted users and their authenticated clients to manage Ruckus infrastructure via a secure protocol such as HTTPS or SSH.
CVSS v3: 8.2
CWE-321: Use of Hard-coded Cryptographic Key
RND uses a secret key on the backend web server to ensure that session JWTs are valid. This secret key is hardcoded into the web server. Anyone with knowledge of the secret key could create a valid JWT, thus bypassing the typical authentication to access the server with administrator privileges.
No patches have been supplied by the vendor at this time. To mitigate risk, network administrators should limit access to the wireless management environments that use these affected products, allowing a limited set of trusted users and their authenticated clients to manage Ruckus infrastructure via a secure protocol such as HTTPS or SSH.
CVSS v3: 9.8
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
An authenticated vSZ user supplies an IP address as an argument to be run in an OS command, but this IP address is not sanitized. A user could supply other commands instead of an IP address to achieve RCE.
No patches have been supplied by the vendor at this time. To mitigate risk, network administrators should limit access to the wireless management environments that use these affected products, allowing a limited set of trusted users and their authenticated clients to manage Ruckus infrastructure via a secure protocol such as HTTPS or SSH.
CVSS v3: 9.0
