Lucene search

Gjoko KrsticZSL-2018-5473

HistoryJun 10, 2018 - 12:00 a.m.

Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway Privilege Escalation

2018-06-1000:00:00

Gjoko Krstic

zeroscience.mk

1267

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.4%

JSON

Title: Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway Privilege Escalation
Advisory ID: ZSL-2018-5473
Type: Local
Impact: Privilege Escalation
Risk: (3/5)
Release Date: 10.06.2018

Summary

RSLinx Classic is a software platform that allows Logix5000 Programmable Automation Controllers to connect to a wide variety of Rockwell Software applications, and FactoryTalk Linx Gateway is a software that provides an Open Platform Communications (OPC) Unified Architecture (UA) server interface to allow the delivery of information from Rockwell Software applications to Allen-Bradley controllers.

Description

The application suffers from an unquoted search path issue impacting the service ‘dnwhodisp’ for Windows deployed as part of RSLinx and FactoryTalk. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges of the application.

Vendor

Rockwell Automation, Inc. - <https://www.rockwellautomation.com>

Affected Version

Rockwell Automation RSLinx Classic 3.90.01
Rockwell Automation RSLinx Classic 3.73.00
Rockwell Automation RSLinx Classic 3.72.00
Rockwell Automation RSLinx Classic 2.58.00
Rockwell Automation FactoryTalk Linx Gateway 3.90.00

Tested On

Microsoft Windows 7 Professional SP1 (EN)

Vendor Status

[11.12.2017] Vulnerability discovered.
[11.12.2017] Vendor contacted.
[11.12.2017] Vendor responds asking more details, providing PGP key.
[11.12.2017] Sent details to the vendor.
[19.12.2017] Asked vendor for status update.
[20.12.2017] Vendor is investigating the issue.
[27.02.2018] Asked vendor for status update.
[27.02.2018] Vendor verifies the issues, working on a fix.
[13.03.2018] Asked vendor for status update.
[04.06.2018] Vendor replies with release information. Provides fixed version RSLinx Classic 4.00.01 and FactoryTalk Linx Gateway 6.00.00 to its customers.
[06.06.2018] Vendor sends draft advisory to ZSL.
[07.06.2018] Replied to the vendor.
[10.06.2018] Coordinated public security advisory released.

PoC

rslinx_eop.txt

Credits

Vulnerability discovered by Gjoko Krstic - <[email protected]>

References

[1] <https://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?crumb=112>
[2] <https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-10619>
[3] <https://nvd.nist.gov/vuln/detail/CVE-2018-10619>
[4] <https://ics-cert.us-cert.gov/advisories/ICSA-18-158-01>
[5] <https://www.securityfocus.com/bid/104415>
[6] <https://packetstormsecurity.com/files/148187>
[7] <https://www.exploit-db.com/exploits/44892/>
[8] <https://cxsecurity.com/issue/WLB-2018060148>
[9] <https://exchange.xforce.ibmcloud.com/vulnerabilities/144534>
[10] <https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073800>
[11] <https://www.rockwellautomation.com/en-us/support/advisory.PN1026.html>

Changelog

[10.06.2018] - Initial release
[22.06.2018] - Added reference [6], [7], [8], [9] and [10]
[31.01.2024] - Added reference [11]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: [email protected]

<html><body><p>Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway Privilege Escalation

Vendor: Rockwell Automation, Inc.
Product web page: https://www.rockwellautomation.com
Affected version: Rockwell Automation RSLinx Classic 3.90.01
                  Rockwell Automation RSLinx Classic 3.73.00
                  Rockwell Automation RSLinx Classic 3.72.00
                  Rockwell Automation RSLinx Classic 2.58.00
                  Rockwell Automation FactoryTalk Linx Gateway 3.90.00

Summary: The FactoryTalk Linx Gateway adds a Classic OPC DA and OPC UA server
interface to deliver information collected by FactoryTalk Linx from Logix5000
and other Allen-Bradley® controllers to external OPC clients, permitting
third-party software to coexist with FactoryTalk® software.

RSLinx Classic is the most widely-installed Communications software in
automation today. All editions of RSLinx Classic deliver the ability to
browse your automation networks, configure and diagnose network devices.
RSLinx Classic supports a wide range of applications through a scalable
offerings that provide both DDE and Classic OPC DA data servers to permit
3rd party software to access information within your control system.

Desc: The application suffers from an unquoted search path issue impacting
the service 'dnwhodisp' for Windows deployed as part of RSLinx and FactoryTalk.
This could potentially allow an authorized but non-privileged local user to
execute arbitrary code with elevated privileges on the system. A successful
attempt would require the local user to be able to insert their code in the
system root path undetected by the OS or other security applications where
it could potentially be executed during application startup or reboot. If
successful, the local user's code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows 7 Professional SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5473
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5473.php

NCCIC ID: ICSA-18-158-01
NCCIC URL: https://ics-cert.us-cert.gov/advisories/ICSA-18-158-01

CVE ID: CVE-2018-10619
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-10619
         https://nvd.nist.gov/vuln/detail/CVE-2018-10619

Bugtraq ID: 104415
Bugtraq URL: https://www.securityfocus.com/bid/104415

11.12.2017

--


C:\&gt;sc qc dnwhodisp
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: dnwhodisp
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Rockwell Software\RSLINX\dnwhodisp.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : dnWhoDisp
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem
</p></body></html>