Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.0381
Advisory (icsa-22-025-01) GE Gas Power ToolBoxST
27 January 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: GE Gas Power ToolBoxST
Publisher: ICS-CERT
Operating System: Network Appliance
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Overwrite Arbitrary Files -- Existing Account
Create Arbitrary Files -- Existing Account
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-44477 CVE-2018-16202
Original Bulletin:
https://us-cert.cisa.gov/ics/advisories/icsa-22-025-01
- --------------------------BEGIN INCLUDED TEXT--------------------
ICS Advisory (ICSA-22-025-01)
GE Gas Power ToolBoxST
Original release date: January 25, 2022
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided
"as is" for informational purposes only. The Department of Homeland Security
(DHS) does not provide any warranties of any kind regarding any information
contained within. DHS does not endorse any commercial product or service,
referenced in this product or otherwise. Further dissemination of this product
is governed by the Traffic Light Protocol (TLP) marking in the header. For
more information about TLP, see https://us-cert.cisa.gov/tlp/ .
1. EXECUTIVE SUMMARY
o CVSS v3 7.5 o ATTENTION: Exploitable remotely/low attack complexity o
Vendor: GE Gas Power o Equipment: ToolBoxST o Vulnerabilities: Improper
Restriction of XML External Entity Reference, Path Traversal
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in data
exfiltration or arbitrary write, overwrite, and execution.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
GE reports these vulnerabilities affect the following software platform for
programming:
o ToolBoxST OS: All versions prior to 07.09.07C
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity
(XXE) vulnerability using the DTD parameter entities technique that could
result in disclosure and retrieval of arbitrary data on the affected node via
an out-of-band (OOB) attack. The vulnerability is triggered when input passed
to the XML parser is not sanitized while parsing the XML project/template
file.
CVE-2021-44477 has been assigned to this vulnerability. A CVSS v3 base score
of 7.5 has been calculated; the CVSS vector string is (
AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:N/A:N ).
3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY (PATH
TRAVERSAL) CWE-22
ToolBoxST prior to Version 7.8.0 uses a vulnerable version of the Ionic .NET
Zip library that does not properly sanitize path names allowing files to be
extracted to a location above their parent directory and back to the root
directory. If an attacker compromises an HMI or creates their own SDI client,
they can upload the device.zip file from a controller, patch it to contain a
malicious file and path, and download it back to the controller. The next user
to perform an upload could grab the malicious device.zip and extract it to
their HMI, creating the potential for arbitrary write, overwrite, and
execution.
CVE-2018-16202 has been assigned to this vulnerability. A CVSS v3 base score
of 6.8 has been calculated; the CVSS vector string is (
AV:N/AC:L/PR:L/UI:R/S:U/ C:L/I:H/A:L ).
3.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS: Communications, Critical Manufacturing,
Energy, Healthcare and Public Health, Transportation Systems, Water and
Wastewater Systems o COUNTRIES/AREAS DEPLOYED: Worldwide o COMPANY
HEADQUARTERS LOCATION: United States
3.4 RESEARCHER
Sharon Briznov of Claroty reported these vulnerabilities to GE.
4. MITIGATIONS
GE addressed CVE-2021-44477 in ToolBoxST OS Version 07.09.07C and above by
disabling the use of DTD's, which are not necessary for ToolBoxST
functionality.
GE upgraded the Ionic library in ToolBoxST Version 7.8.0 to resolve
CVE-2018-16202
Users should ensure they follow the password protection and network
segmentation guidance laid out in GEH-6839 Secure Deployment Guide.
Additionally, the use of SDI Secure Mode offers considerable protection
against this attack as the threat actor must be able to perform a download to
the controller over SDI. Secure Mode validates authenticity and protects
against spoofing of SDI commands.
GE Gas Power Cybersecurity and Engineering teams will continue to investigate
internally as well as monitor industry-based news for any changes or updates.
To reduce the risk vulnerabilities such as these may represent to the controls
network, GE recommends the implementation of a good defense-in-depth strategy
as detailed in GEH-6839. Some recommended controls include:
o Minimize network exposure for all controllers with the use of network
segmentation, placement of controllers behind controls network firewalls and
ensure they are not accessible from the Internet. o Block suspicious external
IP addresses at the controls network firewalls. Monitor traffic internally for
unusual behavior. o When remote access is required, use secure methods, such
as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities
and should be updated to the most current version available. Also recognize
VPN is only as secure as its connected devices. o Implement defense-in-depth
within the controls network environment consisting of tools such as Intrusion
detection/prevention systems (IDS/ IPS), firewalls, and network access control
(NAC). o Implement and maintain an anti-malware solution and an endpoint
detection and response (EDR) solution. o Disable remote access services and
protocols such as remote desktop protocol (RDP) unless needed. Monitor and
restrict remote access usage on a least-privilege basis. o Have backup and
restore processes and procedures in place for disaster recovery and incident
response. o Monitor and maintain account provisioning and access control based
on the principle of least privilege.
For more information, please see the GE advisory on the GE security page .
Users can also contact GE Power PSIRT for specific mitigations.
CISA recommends users take defensive measures to minimize the risk of
exploitation of these vulnerabilities. CISA reminds organizations to perform
proper impact analysis and risk assessment prior to deploying defensive
measures.
CISA also provides a section for control systems security recommended
practices on the ICS webpage on cisa.gov . Several recommended practices are
available for reading and download, including Improving Industrial Control
Systems Cybersecurity with Defense-in-Depth Strategies .
Additional mitigation guidance and recommended practices are publicly
available on the ICS webpage on cisa.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves
from social engineering attacks:
o Do not click web links or open unsolicited attachments in email messages.
o Refer to Recognizing and Avoiding Email Scams for more information on
avoiding email scams. o Refer to Avoiding Social Engineering and Phishing
Attacks for more information on social engineering attacks.
No known public exploits specifically target these vulnerabilities.
For any questions related to this report, please contact the CISA at:
Email: CISAservicedesk@cisa.dhs.gov Toll Free: 1-888-282-0870
CISA continuously strives to improve its products and services. You can help
by choosing one of the links below to provide feedback about this product.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYfI6M+NLKJtyKPYoAQhqLg/9EcLyCKG+8qnM4hxugmjC4ARHhe4kdPa1
UqvB693gxPQZn25i92DGkyIJnh+4//KchzHbSZY4vnYU1pR7KmEHzZU/ScgFrO5s
CYS4pqcZkBTBa0+OO9URG9xHxGiGV3NJBeZkvcme+ZVLKNFWuMJG28ZuY9U9tUW6
+2EzKF02CHW1LlgV6Znn2h19Cr9TLen5LS9ZBD6/r2gr3itbBBNwR2OvEVX5Ker8
+yaCphO6tNZRneOPTj/ODov991qdu0kPkf0JWzukFGI0BcxtPWVTVpnf6HySMLpi
L09NOlgbOZDlRH4opPrjhY3g6ntScRBRkn7huHNWOiXcpMdn2NcwVpgB88gi639Y
gH1wD3rhtgwaH6qu6nnl5M2OgFeKG7tgVwrL9YSMwtGL1hXSosBH7X3rjAhsAp2G
L2xvpi1qwVZnEhuTdRemoBcSqb24ia9ZsL/tuffF3nwZVAoJHy4861eoBj2wqzuJ
rfZ0dzLiTr97iD8Wji4Turl08Ma5zUHQ4aIHHKCPjKvo1dG7b40pyK0omXD7K5+f
cwtmLKAZMbnsgj/FV7626uyB7hwr1ZNUCYDQGUrU5jfygZCyAlQXCMm+WxQv07kP
x5O2RswIDaIObcia4zyHZNlavKs7G/Ut+qtmWzYda/AtKw+k62urNDeKmGRSWBmq
g5kZFVDfRkk=
=mWuH
-----END PGP SIGNATURE-----