Listen to this Post
How the CVE Works
This vulnerability exists within the `view_edit.shtm` endpoint of the ScadaBR application, which is a component of the OpenPLC suite. Authenticated attackers, regardless of privilege level, can interact with this endpoint. The flaw is an arbitrary file upload vulnerability where the application fails to properly validate or sanitize file uploads. Specifically, it does not restrict the file extension or validate the content of uploaded files. An attacker can craft an HTTP POST request containing a malicious Java Server Pages (JSP) file payload. When this file is uploaded via the vulnerable endpoint, it is stored on the server’s filesystem within the web root or an accessible directory. Subsequently, the attacker can send a simple HTTP GET request to the location of the uploaded JSP file. The web server, recognizing the `.jsp` extension, will execute the file’s code within the context of the ScadaBR/OpenPLC application process. This allows for full remote code execution with the same permissions as the running web service, typically compromising the entire PLC and SCADA system.
DailyCVE Form
Platform: OpenPLC ScadaBR
Version: Through 0.9.1 (Linux) and 1.12.4 (Windows)
Vulnerability: Arbitrary File Upload
Severity: Critical
Date: 2021-12-07
Prediction: Patch expected Q4 2021
What Undercode Say:
Analytics
`curl -v http://[bash]/scadabr/view_edit.shtm`
`grep -r “view_edit” webapp_source/</h2>
<h2 style="color: blue;">find /var/lib/tomcat9/webapps/ -name “.jsp” -newermt 2024-01-01</h2>
<h2 style="color: blue;">Exploit</h2>
<h2 style="color: blue;">1. Attacker authenticates to ScadaBR.</h2>
<h2 style="color: blue;">2. POSTs malicious JSP file to/scadabr/view_edit.shtm.</h2>
<h2 style="color: blue;">3. File saved in web directory (e.g.,/webapps/ScadaBR/uploaded_cmd.jsp`).
<h2 style="color: blue;">
<h2 style="color: blue;">Exploit</h2>
<h2 style="color: blue;">1. Attacker authenticates to ScadaBR.</h2>
<h2 style="color: blue;">2. POSTs malicious JSP file to
<h2 style="color: blue;">3. File saved in web directory (e.g.,
4. GET request executes JSP payload.
5. Shell access achieved.
Protection from this CVE
1. Apply vendor patch.
2. Implement strong file validation (whitelist extensions).
3. Run service with minimal privileges.
4. Isolate SCADA network.
Impact
Full system compromise. Unauthorized PLC control. SCADA data manipulation. Critical infrastructure disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
