Talos Vulnerability Report

TALOS-2020-1108

Aveva eDNA Enterprise Data Historian ednareporting.asmx Multiple SQL injection Vulnerabilities

September 23, 2020

CVE Number

CVE-2020-13503, CVE-2020-13504, CVE-2020-13505, CVE-2020-13521

Summary

Multiple SQL injection vulnerabilities exists in the ednareporting.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. An attacker can send unauthenticated HTTP requests to trigger these vulnerabilities.

Tested Versions

Aveva eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053

Product URLs

<https://sw.aveva.com/asset-performance/industrial-information-management/enterprise-data-management&gt;

CVSSv3 Score

9.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)

Details

.eDNA Enterprise Data Historian is highly scalable software platform that efficiently archives and quickly retrieves time-series data in business and operational environments.

Multiple SQL injection vulnerabilities exist within the web service as an unauthenticated user. A successful attack could allow an unauthenticated attacker to access information such as usernames and password hashes that are stored in the database.

CVE-2020-13503 - Parameter AttFilterName

Parameter AttFilterName in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks:

POST /webservice/ednareporting.asmx HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: "http://instepsoftware/webservice/GetClassAttributeCVReportbyAttValueFilter"
User-Agent: agent
Host: [IP]
Content-Length: 911

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://instepsoftware/webservice">
  <soapenv:Header/>
  <soapenv:Body>
     <web:GetClassAttributeCVReportbyAttValueFilter>
        <web:psInstance>1a</web:psInstance>
        <web:psClass>1b</web:psClass>
        <web:psAttribute>1c</web:psAttribute>
        <web:FilterMin>aa</web:FilterMin>
        <web:FilterMax>aab</web:FilterMax>
        <web:AttFilterName>(SQL INJECTION)</web:AttFilterName>
        <web:AttFilterValue>aabc</web:AttFilterValue>
     </web:GetClassAttributeCVReportbyAttValueFilter>
  </soapenv:Body>
</soapenv:Envelope>

CVE-2020-13504 - Parameter AttFilterValue

Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks:

POST /webservice/ednareporting.asmx HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: "http://instepsoftware/webservice/GetClassAttributeCVReportbyAttValueFilter"
User-Agent: agent
Host: [IP]
Content-Length: 911

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://instepsoftware/webservice">
  <soapenv:Header/>
  <soapenv:Body>
     <web:GetClassAttributeCVReportbyAttValueFilter>
        <web:psInstance>1a</web:psInstance>
        <web:psClass>1b</web:psClass>
        <web:psAttribute>1c</web:psAttribute>
        <web:FilterMin>aa</web:FilterMin>
        <web:FilterMax>aab</web:FilterMax>
        <web:AttFilterName>aabcd</web:AttFilterName>
        <web:AttFilterValue>(SQL INJECTION)</web:AttFilterValue>
     </web:GetClassAttributeCVReportbyAttValueFilter>
  </soapenv:Body>
</soapenv:Envelope>

CVE-2020-13505 - Parameter psClass

Parameter psClass in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks:

POST /webservice/ednareporting.asmx HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: "http://instepsoftware/webservice/GetClassAttributeCVReportbyAttValueFilter"
User-Agent: agent
Host: [IP]
Content-Length: 911

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://instepsoftware/webservice">
  <soapenv:Header/>
  <soapenv:Body>
     <web:GetClassAttributeCVReportbyAttValueFilter>
        <web:psInstance>1a</web:psInstance>
        <web:psClass>(SQL INJECTION)</web:psClass>
        <web:psAttribute>1c</web:psAttribute>
        <web:FilterMin>aa</web:FilterMin>
        <web:FilterMax>aab</web:FilterMax>
        <web:AttFilterName>aabcd</web:AttFilterName>
        <web:AttFilterValue>aabc</web:AttFilterValue>
     </web:GetClassAttributeCVReportbyAttValueFilter>
  </soapenv:Body>
</soapenv:Envelope>

CVE-2020-13506 - Parameter psInstance

Parameter psInstance in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks:

POST /webservice/ednareporting.asmx HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: "http://instepsoftware/webservice/GetClassAttributeCVReportbyAttValueFilter"
User-Agent: agent
Host: [IP]
Content-Length: 911

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://instepsoftware/webservice">
  <soapenv:Header/>
  <soapenv:Body>
     <web:GetClassAttributeCVReportbyAttValueFilter>
        <web:psInstance>(SQL INJECTION)</web:psInstance>
        <web:psClass>1b</web:psClass>
        <web:psAttribute>1c</web:psAttribute>
        <web:FilterMin>aa</web:FilterMin>
        <web:FilterMax>aab</web:FilterMax>
        <web:AttFilterName>aabcd</web:AttFilterName>
        <web:AttFilterValue>aabc</web:AttFilterValue>
     </web:GetClassAttributeCVReportbyAttValueFilter>
  </soapenv:Body>
</soapenv:Envelope>

CVE-2020-13521 - Parameter psAttribute

Parameter psAttribute in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks:

POST /webservice/ednareporting.asmx HTTP/1.1 Accept-Encoding: gzip,deflate Content-Type: text/xml;charset=UTF-8 SOAPAction: “http://instepsoftware/webservice/GetClassAttributeCVReportbyAttValueFilter” User-Agent: agent Host: [IP] Content-Length: 911

1a 1b (SQL INJECTION) aa aab aabcd aabc

Timeline

2020-07-10 - Vendor disclosure
2020-08-10 - Vendor provided patch for Talos to test
2020-08-21 - Talos confirmed fix/patch
2020-09-23 - Public disclosure release

Credit

Discovered by Yuri Kramarz of Cisco Talos.

---

Vulnerability Reports Next Report

TALOS-2020-1107

Previous Report

TALOS-2020-1109