[FD] Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in atvise 
SCADA 3.13.0 (atvise GmbH / Bachmann Visutec). The research is published and a 
proof-of-concept is available.

Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)

The main service process atserver runs as root and exposes two independent 
authentication backends: a WebMI HTTP backend that verifies passwords, and an 
OPC UA binary protocol backend on port 4840 that does not. The OPC UA 
logonSessionUser path never calls the password-verification function; it only 
checks that the SYSTEM.SECURITY.USERS.<username> node exists. Any non-empty 
password for root yields a superuser session, even under a strong root 
password. The chain combines this auth bypass with an OPC UA write that 
overwrites a built-in WebMI method's V8 script, an anonymous WebMI session 
built via a digest bypass, and an anonymous POST that triggers the tampered V8 
script. The V8 engine runs inside atserver (root), so the injected script 
inherits root and executes arbitrary commands. The chain was verified by 
reading /etc/shadow. The only precondition is that the WEBACCESS module is 
loaded, which is the normal running state of a licensed production deployment.

Impact: Complete host compromise as root; the attacker can read any file, 
execute arbitrary commands, and alter SCADA control logic and node values.

Advisory: https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce

Vulnerability 2: Default-credential RCE (CVSS 8.8, authenticated)

The WebHMI service (Boost.Beast HTTP on ports 80/443) uses a custom WebMI 
authentication scheme. The built-in root user ships with a factory default 
empty password, and the handleLogin handler has a 'password not set' branch 
that grants the superuser session for an existing user without verifying the 
supplied passwords while that default state is in place. The chain combines the 
default-credential login (login(root, any value) yields the root superuser 
session), a V8 ScriptCode injection via AddNode, a ReportRunConfiguration 
trigger that loads the attacker script into the embedded V8 engine, and a 
ChildProcess.execAsync payload. The V8 engine runs inside atserver (root), so 
the injected script inherits root. Setting a strong root password via 
changepassword closes the login bypass. The only precondition is that the 
WEBACCESS module is loaded.

Impact: Complete host compromise as root; the attacker can read any file, 
execute arbitrary commands, and alter SCADA control logic and node values.

Advisory: https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/