Schneider Electric ClearSCADA Vulnerabilities: XSS, Auth Bypass, Weak Hashing

Vulnerability Key Information Vulnerability Overview Independent researcher Aditya Sood discovered weak hashing algorithms and cross-site scripting (XSS) vulnerabilities in Schneider Electric’s StruxureWare SCADA Expert ClearSCADA. Schneider Electric identified additional vulnerabilities in the StruxureWare SCADA Expert ClearSCADA product line. Affected Products ClearSCADA 2010 R3 (build 72.4560) ClearSCADA 2010 R3.1 (build 72.4644) SCADA Expert ClearSCADA 2013 R1 (build 73.4729) SCADA Expert ClearSCADA 2013 R1.1 (build 73.4832) SCADA Expert ClearSCADA 2013 R1.1a (build 73.4903) SCADA Expert ClearSCADA 2013 R1.2 (build 73.4955) SCADA Expert ClearSCADA 2013 R2 (build 74.5094) SCADA Expert ClearSCADA 2013 R2.1 (build 74.5192) SCADA Expert ClearSCADA 2014 R1 (build 75.5210) Impact The cross-site scripting vulnerability can be exploited to trick users with system administration privileges into executing a remote shutdown of the ClearSCADA server via the WebX client. The authentication bypass vulnerability can be exploited to expose sensitive system information to users without requiring login credentials. ClearSCADA uses self-signed network certificates employing the MD5 algorithm, which is an outdated and weak hashing algorithm that may be decrypted, enabling attackers to gain access to the system. Detailed Information Cross-Site Scripting (CWE-79): Attackers must trick users with system administration privileges into interacting with the WebX client to exploit this vulnerability and remotely shut down the ClearSCADA server. Authentication Bypass (CWE-287): The guest user account in ClearSCADA installations has read access to the ClearSCADA database, potentially leading to exposure of sensitive system information. Weak Hashing Algorithm (CWE-310): ClearSCADA uses self-signed network certificates with the MD5 algorithm, which may be decrypted, allowing attackers to compromise keys hashed with this algorithm. Exploitability The authentication bypass and weak hashing algorithm vulnerabilities can be exploited remotely. The cross-site scripting vulnerability requires user interaction to be exploited. Mitigation Measures Schneider Electric has released new service packs to mitigate these vulnerabilities. It is recommended that asset owners obtain signed network certificates from a certification authority before deploying the ClearSCADA web server in production environments. Field owners should restrict system access to authorized users only. Disable the “Allow database shutdown via WebX” option in the ClearSCADA server configuration utility. Upgrade to the latest service packs: - ClearSCADA 2010 R3.2, released in October 2014 - SCADA Expert ClearSCADA 2014 R1.1, released in October 2014

Goal Reached Thanks to every supporter — we hit 100%!

Schneider Electric ClearSCADA Vulnerabilities: XSS, Auth Bypass, Weak Hashing