Progea Movicon 11.5.1181 Search Path Issues

`Vendor: Progea  
Equipment: Movicon SCADA/HMI  
Vulnerability: Uncontrolled Search Path Element, Unquoted Search Path or  
Element  
  
Advisory URL  
https://ipositivesecurity.com/2017/10/28/ics-progea-movicon-scadahmi-vulnerabilities/  
  
ICS-CERT Advisory  
https://ics-cert.us-cert.gov/advisories/ICSA-17-290-01  
  
CVE-ID  
CVE-2017-14017  
CVE-2017-14019  
  
------------------------  
AFFECTED PRODUCTS  
------------------------  
The following versions of Movicon HMI, an HMI software platform, are  
affected:  
Movicon Version 11.5.1181 and prior.  
  
------------------------  
BACKGROUND  
------------------------  
Critical Infrastructure Sectors: Critical Manufacturing, Energy, Food and  
Agriculture, Transportation Systems, Water and Wastewater Systems  
Countries/Areas Deployed: Europe, India, and United States  
Company Headquarters Location: Italy  
  
  
------------------------  
IMPACT  
------------------------  
Successful exploitation of these vulnerabilities could allow privilege  
escalation or arbitrary code execution.  
  
  
------------------------  
VULNERABILITY OVERVIEW  
------------------------  
  
UNCONTROLLED SEARCH PATH ELEMENT CWE-427  
An uncontrolled search path element vulnerability has been identified,  
which may allow a remote attacker without privileges to execute arbitrary  
code in the form of a malicious DLL file.  
  
This vulnerability allows remote attackers to execute arbitrary code on  
vulnerable installations of Movicon SCADA/HMI. User interaction is required  
to exploit this vulnerability in that the malicious dll file should be  
saved in any of the DLL search paths.  
  
The specific flaw exists within the handling of a specific named DLL file  
used by Movicon SCADA/HMI. By placing specific DLL file (listed below), an  
attacker is able to force the process to load an arbitrary DLL. This allows  
an attacker to execute arbitrary code in the context of the process.  
  
------------------------  
DLL File Name (1)  
------------------------  
api-ms-win-appmodel-runtime-l1-1-0.dll  
  
------------------------  
Application Executables (that look for missing DLL)  
------------------------  
Movicon.exe  
MoviconRunTime.exe  
MoviconService.exe  
AlarmsImpExp.exe  
ReportViewerNET.exe  
  
------------------------  
Steps to reproduce  
------------------------  
  
1. Generate a dll payload  
msfvenom ap windows/exec cmd=calc.exe af dll ao  
api-ms-win-appmodel-runtime-l1-1-0.dll  
  
2. Place this dll in install directory (or C:\Windows, or any directory  
defined in the PATH environment variable)  
C:\Program Files\Progea\Movicon11.5\  
  
3. Run MoviconService.exe (or any of the above listed executables), and Exit  
  
------------------------  
CVE-2017-14017 has been assigned to this vulnerability. A CVSS v3 base  
score of 6.8 has been assigned; the CVSS vector string is  
(AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).  
  
  
UNQUOTED SEARCH PATH OR ELEMENT CWE-428  
An unquoted search path or element vulnerability has been identified, which  
may allow an authorized local user to insert arbitrary code into the  
unquoted service path and escalate his or her privileges.  
  
A successful attempt would require the local user to be able to insert  
their code in the system root path undetected by the OS or other security  
applications where it could potentially be executed during application  
startup or reboot. If successful, the local useras code would execute with  
the elevated privileges of the application.  
  
aC/ MOVICON (MOVICON) runs as LocalSystem and has path: C:\Program  
Files\Progea\Movicon11.5\MoviconService.exe:  
  
CVE-2017-14019 has been assigned to this vulnerability. A CVSS v3 base  
score of 6.5 has been assigned; the CVSS vector string is  
(AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).  
  
+++++  
  
Best Regards,  
Karn Ganeshen  
  
  
`