High-Severity Flaw Reported in Critical System Used by Oil and Gas Companies

Cybersecurity researchers have disclosed details of a new
vulnerability in a system used across oil and gas organizations
that could be exploited by an attacker to inject and execute
arbitrary code.

The vulnerability, tracked as CVE-2022-0902^[1]
(CVSS score: 8.1), is a path-traversal vulnerability in ABB
Totalflow flow computers and remote
controllers^[2].

“Attackers can exploit this flaw to gain root access on an ABB
flow computer, read and write files, and remotely execute code,”
industrial security company Claroty said^[3]
in a report shared with The Hacker News.

ABB, a Swedish-Swiss industrial automation firm, has since
released firmware updates^[4]
as of July 14, 2022, following responsible disclosure.

Flow computers are special-purpose electronic instruments used
by petrochemical manufacturers to interpret data from flow meters
and calculate and record the volume of substances such as natural
gas, crude oils, and other hydrocarbon fluids at a specific point
in time.

These gas measurements are critical not only when it comes to
process safety, but are also used as inputs when bulk liquid or gas
products change hands between parties, making it imperative that
the flow measurements are accurately captured.

In a nutshell, the vulnerability identified by Claroty is a path
traversal flaw that exists in ABB’s implementation of its
proprietary Totalflow TCP protocol, which is utilized to remotely
configure the computers.

The issue, specifically, concerns a feature that allows for
importing and exporting the configuration files, enabling an
attacker to leverage an authentication bypass issue to get past the
security passcode barrier and upload arbitrary files.

By taking advantage of the shortcoming, a remote malicious actor
could seize control of the devices and hamper their ability to
properly record oil and gas flow rates.

“A successful exploit of this issue could impede a company’s
ability to bill customers, forcing a disruption of services,
similar to the consequences^[5]
suffered by Colonial Pipeline following its 2021 ransomware
attack,” Claroty researcher Vera Mens said.