CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
97.4%
GE Fanuc Proficy Information Portal allows authenticated users to upload arbitrary files. An attacker could upload an executable server-side script (e.g., an .asp shell on a Microsoft Internet Information Server platform) and execute arbitrary commands with the privileges of the web server.
GE Fanuc Proficy Information Portal is a web-based systems reporting tool often used to consolidate and integrate online and process-based systems data between Supervisory Control And Data Acquisition (SCADA) systems and the corporate network. Proficy Information Portal supports an βAdd WebSourceβ feature that allows authenticated users to upload arbitrary files to the server. An uploaded file can subsequently be executed by requesting it with a web browser.
This vulnerability affects GE Fanuc Proficy Information Portal up to and including version 2.6.
Exploit code for this vulnerability is publicly available.
By uploading a file that can be executed by the web server (e.g., an .asp shell), a remote, authenticated attacker may be able to execute arbitrary code. The attacker could exploit this behavior to access SCADA networks.
Patch
This vulnerability will be addressed with a Software Improvement Module (SIM) for PROFICY 2.6. For more information about the availability of this SIM, Proficy customers should refer to GE Fanuc knowledge base article KB12460.
Upgrade
Users of affected software with versions older than 2.6 are encouraged to upgrade to 2.6 or greater and then apply the patches described above. For more information, Proficy customers should refer to GE Fanuc knowledge base article KB12460.
Restrict Access
Limit network access to hosts that require connections to the portal. Do not allow access to the portal from untrusted networks such as the internet.
Filter URLs
Using a reverse HTTP proxy, web server URL filtering, or similar technology, it may be possible to restrict the names and extensions of files that can be uploaded to the Proficy Information Portal.
Modify Web Server Permissions
It may be possible to modify web server permissions to prevent file uploads. This may impact portal functionality.
339345
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: December 20, 2007 Updated: January 25, 2008
Statement Date: January 17, 2008
Affected
A product SIM is being developed and is scheduled to be released by February 15th, 2008. For update to date information please consult KB article KB12460 at the GE Fanuc Support Web Site.
We are not aware of further vendor information regarding this vulnerability.
We have no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23339345 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
This vulnerability was reported by Eyal Udassin of C4 Security.
This document was written by Chris Taschner.
CVE IDs: | CVE-2008-0175 |
---|---|
Severity Metric: | 0.84 Date Public: |