exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ICS-CERT Advisory - Sauter ModuWEB Vision SCADA

ICS-CERT Advisory - Sauter ModuWEB Vision SCADA
Posted Feb 5, 2016
Authored by Martin Jartelius

ICS-CERT Advisory 16-033-01 - Sauter ModuWEB Vision SCADA suffers from cross site scripting, insecure credential storage, and insecure transmission of credential vulnerabilities.

tags | advisory, vulnerability, xss
advisories | CVE-2015-7914, CVE-2015-7915, CVE-2015-7916
SHA-256 | 020dced24aeb0fab892ad9d6e6294925cfe9def9de382515d3b7f9216146946a

ICS-CERT Advisory - Sauter ModuWEB Vision SCADA

Change Mirror Download
Vulnerabilities

---------------

CVSS 10 - INSECURE CREDENTIAL STORAGE (Pass the Hash) CVE-2015-7914

CVSS 10 - INSECURE TRANSMISSION OF CREDENTIALS CVE-2015-7915

CVSS 7.4 - CROSS-SITE SCRIPTING CVE-2015-7916



Other risk exposures

---------------

Undocumented default accounts



Note that default accounts with changeable passwords, even when those
are undocumented and do not look as user accounts neither in interface
or documentation, constitute a formal vulnerability. It is at worst a
misconfiguration.



References (Source)

---------------

This advisory:

https://www.outpost24.com/critical-scada-vulnerabilities-sauter-moduweb/



ICS CERT:

https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01


Summary of the issues
---------------
In short – By obtaining access to a system using undocumented accounts,
it is possible to obtain a low privilege level.

By exploiting the fact that the cashed credentials used for the
“remember me” function of the web application employ the same encryption
as the one used for protection of passwords included in backups, a user
can elevate privileges to administrator level.

The backups also contain other encrypted configuration information which
can further an attacker’s access to also affect for example email
accounts used for notifications.

By accessing the system as an administrator, an attacker can obtain
those credentials in plain text from the system as they are included in
the configuration details, protected only by the use of “password”
field-types in the forms.

In essence this constitute a pass the hash vulnerability. Just as with
https://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/
which used hashed inputs to generate secure transfer of credentials over
non encrypted connections, applying the same protection scheme to its
stored, and exposed, secrets.


Don’t do your own cryptography.



A bit more details, sufficient for the interested reader to recreate but
not a straight forward guide, available at the provided references.





Martin Jartelius – CSO – Outpost24
John Stock – Technology Program Director – Outpost24



Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close