exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Trihedral VTScada DoS / XSS / Information Disclosure

Trihedral VTScada DoS / XSS / Information Disclosure
Posted Jun 30, 2017
Authored by Karn Ganeshen

Trihedral VTScada versions prior to 11.2.26 suffer from resource consumption, cross site scripting, and information disclosure vulnerabilities.

tags | advisory, vulnerability, xss, info disclosure
SHA-256 | e14e0d0f4e7e01e5baeffed7b702d91c7d3bbbc0662e4bfd676b5401df83dceb

Trihedral VTScada DoS / XSS / Information Disclosure

Change Mirror Download
Vendor: Trihedral
Equipment: VTScada
Vulnerability: Resource Consumption, Cross-Site Scripting, Information
Exposure
Advisory URL:
https://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/

ICS-CERT Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-164-01

------------------------
AFFECTED PRODUCTS
------------------------
The following versions of VTScada, an HMI SCADA software, are affected:

VTScada Versions prior to 11.2.26

------------------------
IMPACT
------------------------

Successful exploitation of these vulnerabilities could result in
uncontrolled resource consumption, arbitrary code execution, or information
exposure.

------------------------
VULNERABILITY OVERVIEW
------------------------

UNCONTROLLED RESOURCE CONSUMPTION CWE-400
<https://cwe.mitre.org/data/definitions/400.html>

The client does not properly validate the input or limit the amount of
resources that are utilized by an attacker, which can be used to consume
more resources than are available.

CVE-2017-6043
<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-6043> has been
assigned to this vulnerability. A CVSS v3 base score of 7.5 has been
assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H>
).

Exploitation

Note that this vulnerability targets the VTScada thick client installed on
the system. Any application user (including a non-admin, restricted user)
who has access to the thick client can potentially bring down the system.

Payload can be up to ~80k characters. Repeated attempts result in spiked
CPU usage & consumption of RAM / page resources. Where a full-blown
application (or multiple applications in production scenario) is deployed,
i.e. with an operational/functional configuration, memory/CPU usage is
notably higher than that of a test, blank application. Repeatedly
submitting such a large username input, rapidly consumes available server
memory resources leading to resource exhaustion. This forces a system
reboot eventually.

Where an endpoint security solution (such as AV/HIPS/Anti-Malware) is
deployed on the system, resource exhaustion may be achieved relatively much
faster (quickly).

CROSS-SITE SCRIPTING CWE-79 <https://cwe.mitre.org/data/definitions/79.html>

A cross-site scripting vulnerability may allow JavaScript code supplied by
the attacker to execute within the useras browser.

CVE-2017-6053
<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-6053> has been
assigned to this vulnerability. A CVSS v3 base score of 6.5 has been
assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N>
).

Exploitation

Multiple URLs and parameters were found to vulnerable to Reflected
Cross-Site Scripting.

INFORMATION EXPOSURE CWE-548
<https://cwe.mitre.org/data/definitions/548.html>

Some files are exposed within the web server application to unauthenticated
users. These files may contain sensitive configuration information.

CVE-2017-6045
<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-6045> has been
assigned to this vulnerability. A CVSS v3 base score of 7.5 has been
assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N>
).

+++++


Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close