ABB Central Licensing System Permissions, Privileges, and Access Controls (CVE-2020-8476)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500940);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2020-8476");

  script_name(english:"ABB Central Licensing System Permissions, Privileges, and Access Controls (CVE-2020-8476)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"For the Central Licensing Server component used in ABB products ABB
Ability System 800xA and related system extensions versions 5.1, 6.0
and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0,
1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+
Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody
Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3),
Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability
System 800xA/ Advant OCS Control Builder A 1.3 and 1.4, Advant OCS
AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild
3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link
2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing
Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage
versions 5.1 to 5.6.5, a weakness in validation of input exists that
allows an attacker to alter licenses assigned to the system nodes by
sending specially crafted messages to the CLS web service.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4dee9024");
  # https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a992067f");
  # https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c613e3e8");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-20-154-04");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

ABB recommends the following mitigations:

- Upgrade ABB CLS to the following versions: 
    - 5.1 Rev A (5.1.0.38)
    - 5.1 Rev E (5.1.0.99)
    - 6.0 (6.0.0.26)
    - 6.0.3.3 (6.0.03000.192)
    - 6.1 RU1 (6.1.00100.417)
    - If ABB Central Licensing Server 5.1 (5.1.0.14) or earlier has been used on the currently used hardware, please
contact ABB for further assistance.
- Vulnerabilities pertaining to CVE-2020-8475 and CVE-2020-8476 will be corrected in future product versions. Updates
will be added to this advisory once they become available.
- Methods for preventing unauthorized access to nodes on the CLS network include but are not limited to usage of IPSec
and by separating the Client Server Network from other networks with firewalls.
- Ensure only authorized individuals have access to user accounts on the system nodes.
- Interactive login to service accounts should be blocked.

For more information, please see ABB's cybersecurity advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-8476");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/04/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:abb:800xa_system");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/a:abb:800xa_system:5.1" :
        {"versionEndIncluding" : "5.1", "versionStartIncluding" : "5.1", "family" : "Abb800xA"},
    "cpe:/a:abb:800xa_system:6.0" :
        {"versionEndIncluding" : "6.0", "versionStartIncluding" : "6.0", "family" : "Abb800xA"},
    "cpe:/a:abb:800xa_system:6.0.1" :
        {"versionEndIncluding" : "6.0.1", "versionStartIncluding" : "6.0.1", "family" : "Abb800xA"},
    "cpe:/a:abb:800xa_system:6.0.3" :
        {"versionEndIncluding" : "6.0.3", "versionStartIncluding" : "6.0.3", "family" : "Abb800xA"},
    "cpe:/a:abb:800xa_system:6.0.3.3" :
        {"versionEndIncluding" : "6.0.3.3", "versionStartIncluding" : "6.0.3.3", "family" : "Abb800xA"},
    "cpe:/a:abb:800xa_system:6.1" :
        {"versionEndIncluding" : "6.1", "versionStartIncluding" : "6.1", "family" : "Abb800xA"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);