OPC UA XML External Entity (XXE) Exploit
20.06.2018
OPC Foundation (OPCF) has announced a Security Bulletin (CVE-2018-12585) on June 20, 2018 concerning a vulnerability in the OPC UA Java Stack of OPC Foundation:
“… that allowed remote attackers to send carefully constructed requests that caused an OPC UA [server] to access unauthorized sites and potentially causing a denial of service.”
The issue is in fact a well know vulnerability in Java (and other environments), related to XML External Entities.
Prosys OPC UA products affected
The vulnerability affects directly:
- All applications built with Prosys OPC UA Java SDK 3.1.2 and earlier
- Prosys OPC UA Client 3.0.0 and earlier
- Prosys OPC UA Simulation Server 3.0.0 and earlier
- Prosys OPC UA Modbus Server 1.2.2 and earlier
- Prosys OPC UA Historian 1.0.0
Fixed products
The issue is now fixed in Prosys OPC UA Java SDK 3.1.4, UA Client 3.1.4, Simulation Server 3.1.4 and Modbus Server 1.2.4 and we encourage everyone to update to these versions. Prosys OPC UA Historian will be updated later, respectively.
Unified Automation products affected
Although this CVE concerns the Java Stack only, a similar CVE (CVE-2017-12069) was already published previously for .NET products.
Unified Automation has released a restricted security bulletin regarding the issue. Please, find more information how to access this from the Unified Automation website.
Fixing the issue with older library versions
The issue is related to a common XXE vulnerability in Java XML components. It has now been fixed in the Java Stack and the respective fix can also be applied to application code directly, if it still needs to be built with an earlier version of the Java Stack and Java SDK. Since the fix is concerning the objects of the XmlFactoryCache and the respective objects are also available via getter methods, you can apply the same fix on these objects (‘getDocumentFactoryBuilder().setAttribute()’, etc.)
Note that the vulnerability cannot be fixed in application binaries only.
Note that the fix requires also a recent Java Virtual Machine, namely Java 7 update 67, Java 8 update 20, or above. Also, it depends on the actual XML parsers used by the JVM. The fix assumes Apache Xerces, which is the default in Oracle JDK and OpenJDK. If you have a custom environment, you will need to check the proper ways to overcome the issue.
More security information
You will find the currently announced security issues in Prosys OPC products from the blog under the #Security tag.
You might also like to read about the OPC UA Security Process of the OPC Foundation.
Jouni Aro
Chief Technology Officer
Email: jouni.aro@prosysopc.com
Expertise and responsibility areas: OPC & OPC UA product development, project work and customer support
About Prosys OPC Ltd
Prosys OPC is a leading provider of professional OPC software and services with over 20 years of experience in the field. OPC and OPC UA (Unified Architecture) are communications standards used especially by industrial and high-tech companies.
Newest blog posts
Why Do Standards Matter in Smart Manufacturing?
The blog post discusses the importance of standards in smart manufacturing, envisioning a future where auto-configurable systems in manufacturing rely on standardized data formats for seamless integration and reduced costs, with a focus on the OPC UA standard family as a key enabler.
OPC UA PubSub to Cloud via MQTT
Detailed overview of the demo presented at the OPC Foundation booth
SimServer How To #3: Simulate data changes on a server using an OPC UA client
A two-part step-by-step tutorial on how to write data changes on an OPC UA server using an OPC UA client.
