PT-2023-25084 · Open Automation · Open Automation Software Oas Platform

A Member · Published 2023-09-05 · Updated 2023-09-08 · CVE-2023-34994

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Open Automation Software OAS Platform version 18.00.0072

Description An improper resource allocation issue exists in the OAS Engine configuration management functionality. A specially crafted series of network requests can lead to the creation of an arbitrary directory. An attacker can send a sequence of requests to trigger this issue, allowing unauthorized users to create new directories anywhere the underlying OAS user system account has access to.

Recommendations For Open Automation Software OAS Platform version 18.00.0072, consider restricting access to the OAS Engine configuration management functionality to prevent unauthorized directory creation until a patch is available. As a temporary workaround, limit the privileges of the OAS user system account to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-34994

Affected Products

Open Automation Software Oas Platform

References · 8

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1773 · Exploit
• https://osv.dev/vulnerability/CVE-2023-34994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34994 · Security Note
• https://t.me/cibsecurity/69871 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1699130562613571795 · Twitter Post
• https://twitter.com/ravirockks/status/1699954483839852952 · Twitter Post
• https://twitter.com/CVEnew/status/1699100224227074249 · Twitter Post
• https://t.me/cvenotify/57818 · Telegram Post