Summary
Several security vulnerabilities in the industrial remote access solution Ewon Cosy+ can be abused to gain root privileges to the devices and stage follow-on attacks, according to new data unveiled at DEF CON 32. The elevated access could then be weaponized to decrypt encrypted firmware files and encrypted data such as passwords in configuration files, and even get correctly signed X.509 VPN certificates for foreign devices to take over their VPN sessions.
Community Impact
While the utilization of Ewon Cosy+ might be marginal within the RH-ISAC Member Community, the potential impact and weaponization due to release of public information regarding the Ewon Cosy+ vulnerability remains a relevant and actionable issue for RH-ISCA Members. RH-ISAC Members who utilize Ewon Cosy+ in their environment are encouraged to review the additional intelligence contained in the SySS report.
Background
Ewon Cosy+’s architecture involves the use of a VPN connection that’s routed to a vendor-managed platform called Talk2m via OpenVPN. Technicians can remotely connect to the industrial gateway by means of a VPN relay that occurs through OpenVPN.
German-based pentest company SySS said it was able to uncover an operating system command injection vulnerability and a filter bypass that made it possible to obtain a reverse shell by uploading a specially crafted OpenVPN configuration.
An attacker could have subsequently taken advantage of a persistent cross-site scripting (XSS) vulnerability and the fact that the device stores the Base64-encoded credentials of the current web session in an unprotected cookie-named credentials to gain administrative access and ultimately root it. The attack chain could then be extended further to set up persistence, access firmware-specific encryption keys, and decrypt the firmware update file.
