[FD] Security advisory: multiple vulnerabilities including JWT forgery / authentication bypass, Pre-authentication SYSTEM RCE in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in CIRCUTOR 
PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.). The research is published and 
a proof-of-concept is available.

Vulnerability 1: Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)

The native engine PwrStudio.exe runs as the Windows service 
CircutorPowerStudioScadaServer under NT AUTHORITY\SYSTEM. The shared fail-open 
JWT library (see companion advisory) accepts a forged alg=none JWT with 
role=Admin. Combined with a path-traversal write of a malicious default.xeve 
events configuration (containing a shellExecute action) against PSSWidgets 
(port 8105) and an HTTP engine restart against PSSAdministrator (port 8089), an 
unauthenticated attacker forces the engine to reload the configuration and fire 
XCEventActionShellExecute::Execute, which reaches CreateProcessW with 
attacker-controlled arguments as SYSTEM. Under a strict default deployment 
where 8089 is loopback-only with no forwarding path, the chain does not close 
for a pure-remote unauthenticated attacker; once 8089 is reachable (reverse 
proxy, rebind, same-host, or same segment), it is a full unauthenticated remote 
SYSTEM RCE.

Impact: Arbitrary command execution as NT AUTHORITY\SYSTEM on the SCADA host; 
the attacker controls the SCADA engine, the event configuration, and the 
underlying Windows host.

Advisory: 
https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce

Vulnerability 2: JWT forgery / authentication bypass (CVSS 8.6, 
pre-authentication)

Every .NET Core microservice registers JWT Bearer authentication via a shared 
extension method configured fail-open: a custom SignatureValidator that always 
returns a non-null token without validating the signature, 
RequireSignedTokens=false, ValidateIssuerSigningKey=false, 
ValidateIssuer=false, ValidateAudience=false, and an OnAuthenticationFailed 
handler that silently swallows exceptions. Any attacker-crafted alg=none JWT 
with any role claim is accepted as a valid authenticated identity by every 
microservice's AdminSecure/UserSecure policy. No credentials, no signing key, 
and no user account are required; only network reachability to the target 
microservice port. This is an authentication-bypass/identity-forgery primitive 
that compromises the product's entire authentication trust root and is the 
auth-bypass primitive that enables the companion shellExecute RCE chain.

Impact: Impersonate any Admin/User role and call any protected endpoint: 
stop/start the SCADA engine or microservices (DoS), push configuration, 
upload/download/delete files, configure external communication, and manage 
licenses; no credentials required.

Advisory: 
https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/