Several New Critical Flaws Affect CODESYS Industrial Automation Software

Cybersecurity researchers on Wednesday disclosed multiple
security vulnerabilities impacting CODESYS automation software and
the WAGO programmable logic controller (PLC) platform that could be
remotely exploited to take control of a company’s cloud operational
technology (OT) infrastructure.

The flaws can be turned “into innovative attacks that could put
threat actors in position to remotely control a company’s cloud OT
implementation, and threaten any industrial process managed from
the cloud,” the New York-headquartered industrial security company
Claroty said in a report^[1]
shared with The Hacker News, adding they “can be used to target a
cloud-based management console from a compromised field device, or
take over a company’s cloud and attack PLCs and other devices to
disrupt operations.”

CODESYS is a development environment for programming controller
applications, enabling easy configuration of PLCs in industrial
control systems. WAGO PFC100/200 is a series of PLCs that make use
of the CODESYS platform for programming and configuring the
controllers.

The list of seven vulnerabilities is listed below –

• CVE-2021-29238^[2] (CVSS score: 8.0) –
  Cross-site request forgery in CODESYS Automation Server
• CVE-2021-29240^[3] (CVSS score: 7.8) –
  Insufficient Verification of Data Authenticity in CODESYS Package
  Manager
• CVE-2021-29241^[4] (CVSS score: 7.5) – Null
  pointer dereference in CODESYS V3 products containing the
  CmpGateway component

• CVE-2021-34569^[5] (CVSS score: 10.0) –
  WAGO PFC diagnostic tools – Out-of-bounds write
• CVE-2021-34566^[6] (CVSS score: 9.1) – WAGO
  PFC iocheckd service “I/O-Check” – Shared memory buffer
  overflow
• CVE-2021-34567^[7] (CVSS score: 8.2) – WAGO
  PFC iocheckd service “I/O-Check” – Out-of-bounds read
• CVE-2021-34568^[8] (CVSS score: 7.5) – WAGO
  PFC iocheckd service “I/O-Check” – Allocation of resources without
  limits

Successful exploitation of the flaws could enable the
installation of malicious CODESYS packages, result in a
denial-of-service (DoS) condition, or lead to privilege escalation
via execution of malicious JavaScript code, and worse, manipulation
or complete disruption of the device.

In the wild, this could play out in one of two ways: “bottom-up”
or “top-down.” The twin approaches mimic the paths an adversary is
likely to take to either control a PLC endpoint in order to
eventually compromise the cloud-based management console, or the
reverse, commandeer the cloud in order to manipulate all networked
field devices.

In a “bottom-up” complex exploit chain devised by Claroty, a mix
of CVE-2021-34566, CVE-2021-34567, and CVE-2021-29238 were
exploited to obtain remote code execution on the WAGO PLC, only to
gain access to the CODESYS WebVisu human-machine interface and
stage a cross-site request forgery (CSRF^[9]) attack to seize control
of the CODESYS automation server instance.

“An attacker that obtains access to a PLC managed by the
Automation Server Cloud can modify the ‘webvisu.js’ file and append
JavaScript code to the end of the file that will send a malicious
request to the cloud server on behalf of the logged in user,”
Claroty senior researcher Uri Katz, who discovered and reported the
flaws, explained.

“When a cloud user views the WebVisu page, the modified
JavaScript will exploit the lack of CSRF token and run in the
context of the user viewing it; the request will include the CAS
cookie. Attackers can use this to POST to ‘/api/db/User’ with a new
administrator user, giving them full access to the CODESYS cloud
platform,” Katz added.

An alternate “top-down” attack scenario, on the other hand,
involves compromising the CODESYS engineering station by deploying
a malicious package (CVE-2021-29240) that’s designed to leak the
cloud credentials associated with an operator account, and
subsequently using it to tamper with the programmed logic and gain
unfettered access to all the connected PLCs.

“Organizations moving forward with cloud-based management of OT
and ICS devices must be aware of the inherent risks, and increased
threats from attackers keen on targeting industrial enterprises
with extortion-based attacks—including ransomware—and more
sophisticated attacks that can cause physical damage,” Katz
said.

The disclosures mark the second time-critical flaws that have
been uncovered in CODESYS and WAGO PLCs in as many months. In June,
researchers from Positive Technologies revealed^[10] ten critical
vulnerabilities in the software’s web server and runtime system
components that could be abused to gain remote code execution on
the PLCs.

The development also comes a week after IoT security firm Armis
disclosed a critical authentication bypass vulnerability affecting
Schneider Electric Modicon PLCs — dubbed “ModiPwn^[11]” (CVE-2021-22779) —
that could be exploited to allow full control over the PLC,
including overwriting critical memory regions, leaking sensitive
memory content, or invoking internal functions.

In a related report published earlier this May, Claroty made
public a memory protection bypass vulnerability in Siemens SIMATIC
S7-1200 and S7-1500 PLCs (CVE-2020-15782^[12]) that could be
leveraged by a malicious actor to remotely gain access to protected
areas of the memory and achieve unrestricted and undetected code
execution.

The revelations also coincide with a joint cybersecurity advisory^[13] released by the U.S.
Cybersecurity and Infrastructure Security Agency (CISA) and the
Federal Bureau of Investigation (FBI) documenting a historical
spear-phishing and intrusion
campaign^[14] conducted by
state-sponsored Chinese actors from December 2011 to 2013,
targeting 23 oil and natural gas (ONG) pipeline operators in the
country.

“CISA and the FBI assess that these actors were specifically
targeting U.S. pipeline infrastructure for the purpose of holding
U.S. pipeline infrastructure at risk,” the agencies said.
“Additionally, CISA and the FBI assess that this activity was
ultimately intended to help China develop cyberattack capabilities
against U.S. pipelines to physically damage pipelines or disrupt
pipeline operations.”