[STANKOINFORMZASCHITA-10-02] ITS SCADA Authorization bypass

[info@xxxxxxxxxxxx]

[STANKOINFORMZASCHITA-10-02] ITS SCADA ? Authorization bypass
Authors: Eugene Salov (eugene@xxxxxxxxxxxx), Andrej Komarov 
(komarov@xxxxxxxxxxxx) 
Product: ITS SCADA 
CVSS v2 Base Score: 9.0 (AV:N/AC:L/Au:R/C:C/I:C/A:C)
Impact Subscore: 10.0
Exploitability Subscore: 8.0
Availability of exploit: Yes

Product description:
ITS SCADA is Supervisory Control And Data Acquisition system (SCADA), which can 
be interfaces with various heterogeneous industrial automation equipment of 
Motorola MOSCAD family. Additionally, it can be installed with elements of 
Wonderware company products environment (Industrial SQL Server, MODBUS I/O 
Server).   
URL: http://www.itsdemo.com 

Vulnerability description:
An unauthorized access of database fields data can be done with help of 
SQL-injection exploitation. Moreover, it can helps attacker to bypass 
authorization without any password validation. 
Database structure:
«RTUinfo»: SiteNum, SiteType, Description;
«Alarms»: EventStamp, AlarmState, TagName, Description, Operator, Provider, 
EventStampUTC;
«BWMInfo»: RTU, SalesLocation, Description, Type, Summ;
«dtproperties»: id, objectid, property, value, uvalue, version;
«FlowData»: Site, iDate, DateTime, Rate, Peak, Average, Total, Lvl;
«sysconstraints»: constid, id, colid, spare1, status, actions, error;
«syssegments»: segment, name, status;
«Users»: UID, Password, AccessLevel.

Given elements of database structure contain various information about 
connected telemetric devices, users, occurred refusals and alarms, execution 
course of technological process performance. 

Exploitation method:
User ID = 1' or 1=(select top 1 password from Users)--
Password = blank

Solution:
There is no available security update for now. It is highly recommended not to 
use default passwords for user authorization. Moreover, additionally you can 
use ACL lists for allowing access only from trusted hosts. Another additional 
mesaure of safety is using of Web Application Firewalls (WAF) and IPS/IDS 
systems in the area where SCADA system is located.

About STC «STANKOINFORMZASCHITA»:
Science Technology Center (STC) «STANKOINFORMZACHITA» is the leading 
information security company in Russian Federation in sphere of automation and 
industrial security, providing information security consulting services, 
information security audit, penetration testing of SCADA and industrial control 
systems.

Contact: info (at) itdefence (dot) ru
Russia, Moscow, Bolshaya Bochtovaya st., 26, Business Center
Tel.: +7 (495) 790-16-60    
http://itdefence.ru