ID

VAR-200801-0248

CVE

CVE-2008-0175

TITLE

GE-Fanuc Proficy Real-Time Information Portal Remote script upload and execution vulnerability

DESCRIPTION

Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory. An attacker can run an executable server-side script ( Example: Windows Internet Information Server of ASP shell Etc.) or execute arbitrary commands with web server execution privileges. GE Fanuc Proficy Information Portal Is a web-based system status reporting system that connects production information systems and inter-enterprise networks and handles data such as production information online. This action could allow an attacker to access a vulnerable production information system.  The Proficy Real-Time Information Portal has a vulnerability in processing user requests, and remote attackers could use this vulnerability to control the server.  Proficy Real-Time Information Portal does not perform the correct Java RMI call to Add WebSource, allowing the user to set the name and path of the file location, and another parameter of the file itself is the base64-encoded content. A successful exploit can allow an attacker to upload arbitrary scripts and execute them in the context of the application. Proficy Real Time Information Portal 2.6 is vulnerable; other versions may also be affected. Background ----------------- GE-Fanuc's Proficy Information Portal 2.6 is a web based reporting application for the SCADA environment. As such it will usually be installed in a buffer zone between the SCADA and the corporate network, which makes it a very sensitive application as it can reach both networks. Impact ---------- An authenticated attacker can compromise the server running Proficy Information Portal, enabling him to progress to the control/process network. Workaround/Fix ----------------------- Vendor fix will be available by Feb 15th. A possible workaround is to remove the write permission of the IIS user from the Proficy directory. Additional Information ------------------------------- For additional information please contact us at info@c4-security.com. Note that we will respond only to verified utility personnel and governmental agencies. The CVE identifier assigned to this vulnerability by CERT is CVE-2008-0175 Credit -------- This vulnerability was discovered and exploited by Eyal Udassin of C4. Regards, Eyal Udassin - C4 (Formerly Swift Coders) 33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel eyal.udassin@c4-security.com / www.c4-security.com <http://www.c4-security.com/> +972-547-684989 . ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Proficy Real-Time Information Portal "Add WebSource" File Upload Vulnerability SECUNIA ADVISORY ID: SA28678 VERIFY ADVISORY: http://secunia.com/advisories/28678/ CRITICAL: Less critical IMPACT: System access WHERE: >From local network SOFTWARE: Proficy Real-Time Information Portal 2.x http://secunia.com/product/17343/ DESCRIPTION: Eyal Udassin has reported a vulnerability in Proficy Real-Time Information Portal, which can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to an error in the "Add WebSource" feature when handling file uploads. This can be exploited to e.g. The vulnerability is reported in version 2.6. Other versions may also be affected. SOLUTION: The vendor will reportedly release a SIM (Software Improvement Module) by February 15, 2008. PROVIDED AND/OR DISCOVERED BY: Eyal Udassin, C4 Security ORIGINAL ADVISORY: GE Fanuc (KB12460): http://support.gefanuc.com/support/index?page=kbchannel&id=KB12460 C4 Security (via BugTraq): http://archives.neohapsis.com/archives/bugtraq/2008-01/0373.html OTHER REFERENCES: US-CERT VU#339345: http://www.kb.cert.org/vuls/id/339345 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

Design error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Eyal Udassin of C4

SOURCES

LAST UPDATE DATE

2025-04-10T23:00:36.707000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE