PT-2018-10133 · Modbuspal · Modbuspal

Trent Gordon · Publicado 2018-05-11 · Atualizado 2018-06-13 · CVE-2018-10832

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ModbusPal version 1.6b

Description The issue allows for an XML External Entity (XXE) attack. This occurs because projects and automations are saved in XML-based files (.xmpp and .xmpa respectively), which are susceptible to XXE injection. By sending a specially crafted .xmpp or .xmpa file to a user, when opened or imported in ModbusPal, it can return the contents of any local files to a remote attacker.

Recommendations For ModbusPal version 1.6b, as a temporary workaround, consider avoiding the use of .xmpp and .xmpa files from untrusted sources until a patch is available. Restrict access to sensitive local files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-10832

Produtos afetados

Modbuspal

Referências · 4

• 🔥 http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/44607 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-10832 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10832 · Aviso do Fabricante