CVE-2022-45792

Executive Summary

CVE-2022-45792 is a directory traversal vulnerability (Zip Slip) in Omron project file handling that allows malicious project files to create and overwrite files on the filesystem with the privileges of the logged-in user. The vulnerability is triggered when a user opens a specially crafted project file, making it a client-side attack vector that requires user interaction to exploit. With a CVSS score of 7.8 and no known patch available, this vulnerability represents a significant supply-chain risk for organizations using Omron industrial automation software.

Technical Analysis

CVE-2022-45792 is classified as a directory traversal vulnerability in the project file format, specifically falling under the "Zip Slip" vulnerability class. The CNA Title explicitly identifies this as "Directory Traversal in Project File Format allows overwrite (Zip Slip)", confirming the attack mechanism.

Vulnerability Mechanism:

Project files used by the affected Omron software are archive-based formats (typically ZIP or similar compressed containers) that contain multiple files representing various project components. The vulnerability arises from insufficient validation of file paths stored within the archive structure. When the software extracts or processes these project files, it fails to properly sanitize path traversal sequences (e.g., ../ or absolute path references) embedded in the archive entries.

The NVD description states: "Project files may contain malicious contents which the software will use to create files on the filesystem." This indicates the software parses entries from the project file and uses the embedded path information to determine where to write or create files on the local system.

Attack Surface:

The attack surface is the project file import/opening functionality within the affected Omron software. This is a client-side attack vector — the victim must open a malicious project file. The attack is performed with "the privileges of the logged-in user," meaning the attacker achieves code execution or file overwrite at the same privilege level as the user running the software.

Technical Limitations:

The NVD description does not specify:

• Which specific Omron software product(s) are affected
• Exact affected version numbers
• The specific archive format used for project files
• Which functions or code paths contain the vulnerability

Insufficient technical detail is available to provide a more granular code-level explanation.

Exploitation Scenarios

Attack Chain (Inferred from Vulnerability Class):

1. Reconnaissance/Target Identification: The attacker identifies organizations using Omron industrial automation software. Targets may include manufacturing facilities, critical infrastructure operators, or engineering firms that manage Omron PLCs and HMIs. The attacker must identify which specific Omron product is used to craft a compatible malicious project file.

2. Flaw Trigger: The attacker crafts a malicious project file containing archive entries with directory traversal sequences (e.g., ../../../../Users/victim/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/malware.exe) designed to escape the intended extraction directory.

3. Payload Execution: The malicious project file is delivered to the victim, typically via email attachment, USB drive, or download from a compromised website. When the victim opens the project file with the vulnerable Omron software, the extraction routine processes the malicious archive entries and writes files to attacker-specified paths on the filesystem. The attacker can:

   • Overwrite critical system files with malicious content
   • Write executable files to startup directories for persistence
   • Replace legitimate application files to compromise software integrity
   • Overwrite configuration files to alter system behavior

4. Post-Exploitation Impact: Since files are written with the privileges of the logged-in user, the attacker achieves code execution at that privilege level. On Windows systems (most likely target given Omron's typical software deployment), this could lead to:

   • Persistence via startup folder or scheduled task manipulation
   • Lateral movement through credential harvesting if user data files are overwritten
   • Manufacturing process compromise if PLC configuration files are altered

PoC Status: No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

CVSS Analysis (7.8 High):

• Attack Vector: Local (AV:L) — The attacker requires local access to deliver the malicious file
• Attack Complexity: Low (AC:L) — The attack is straightforward once the malicious file is delivered
• Privileges Required: Low (PR:L) — The attacker needs limited privileges to craft the file
• User Interaction: Required (UI:R) — The victim must open the malicious project file
• Confidentiality/Integrity/Availability: High/High/High (C:H/I:H/A:H) — Complete compromise of file integrity, potential data exposure, and system availability

Business Impact:

• Manufacturing Disruption: Successful exploitation could allow attackers to overwrite PLC programs or HMI configurations, potentially disrupting industrial processes
• Industrial Control System (ICS) Compromise: In worst-case scenarios, this could serve as an entry point for broader OT network compromise
• Intellectual Property Theft: If the attacker targets project file directories, they could potentially exfiltrate sensitive engineering data
• Supply Chain Risk: The project file attack vector is amenable to watering-hole or spear-phishing campaigns targeting engineering teams

Blast Radius: The vulnerability affects any system running the vulnerable Omron project file software. Given the industrial context, the blast radius includes not just the immediate workstation but potentially the connected OT infrastructure if the compromised machine has access to programmable logic controllers or other ICS components.

EPSS Analysis: EPSS score of 0.00326 (25.3rd percentile) indicates low current exploitation probability, but this may increase as the vulnerability becomes better known and no patch is available.

Detection Guidance

Sigma Rule

title: Suspicious Path Traversal in Omron Project File Extraction
id: 6f4a3c8e-5d2b-4a9f-b1c4-8e3a2d5f7b9c
status: experimental
description: Detects potential Zip Slip exploitation attempts via Omron project files
author: valtersit.com Threat Intelligence
date: 2024/01/15
tags:
    - attack.t1211
    - attack.defense_evasion
    - cve.2022-45792
logsource:
    category: file_event
    product: windows
detection:
    selection_traversal:
        TargetFilename|contains:
            - '..\\'
            - '../'
            - ':\'
    selection_extensions:
        TargetFilename|endswith:
            - '.dll'
            - '.exe'
            - '.bat'
            - '.ps1'
            - '.vbs'
            - '.lnk'
    selection_process:
        Image|endswith:
            - '\Omron*.exe'
            - '\CX*.exe'
            - '\Sysmac*.exe'
    condition: selection_traversal and selection_extensions and selection_process
    timeframe: 5m
level: high
falsepositives:
    - Legitimate software updating its own files

YARA Rule

rule CVE_2022_45792_Omron_ZipSlip_ProjectFile
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects malicious Omron project files containing path traversal patterns"
        date = "2024/01/15"
        cve = "CVE-2022-45792"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-45792"

    strings:
        $zip_magic = { 50 4B 03 04 }  // PK\x03\x04
        $traversal1 = "..\\"
        $traversal2 = "../"
        $traversal3 = "..\\..\\"
        $traversal4 = "../../"
        $abs_windows = "C:\\"
        $abs_windows_lower = "c:\\"
        $startup = "Startup"
        $system32 = "System32"
        $temp = "\\Windows\\"
        $appdata = "AppData"

    condition:
        $zip_magic at 0 and
        (1 of ($traversal*) or 1 of ($abs_windows*) or $system32 or $startup) and
        ($appdata or $temp)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"ET EXPLOIT CVE-2022-45792 Omron Project File Zip Slip Attempt"; flow:established,to_server; content:"PK",offset:0; content:"../"; nocase; content:"|2e 2e 2f|"; pcre:"/\.\.(\/|\\){1,}/"; classtype:attempted-user; sid:2022457920; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2022-45792;)

Elastic Detection

// Detect file write events with traversal patterns from Omron processes
any where 
  process.name : "*.exe" and 
  process.name : ("Omron*", "CX*", "Sysmac*") and
  file.path : ("*..\\*", "*../*", "*:\\*") and
  file.extension : ("dll", "exe", "bat", "ps1", "vbs", "lnk") and
  event.action : ("creation", "modification")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog
| where match(process_path, "(?i)omron|sysmac|cx-") 
| regex target_filename=".*(\\.\\.\\\\|\.\.\/).*\.(exe|dll|bat|ps1|vbs|lnk)$"
| stats count by ComputerName, process_path, target_filename, user, TransactionID
| sort - count

Wazuh OSSEC Rule

<group name="omron_zip_slip,">
  <rule id="100282" level="12">
    <if_sid>550</if_sid>
    <regex>\.\.(\/|\\)</regex>
    <regex>\.(exe|dll|bat|ps1|vbs|lnk)$</regex>
    <field name="process_name">(?i)(omron|sysmac|cx-)</field>
    <description>OMRON project file Zip Slip attempt - path traversal pattern detected (CVE-2022-45792)</description>
    <group>attack.t1211,</group>
    <mitre><id>T1211</id></mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No patch evidence exists from any tracked source at the time of this report. The vendor has not released a security advisory, fix version, or mitigation guidance for this vulnerability.

1. Immediate Mitigations (compensating controls):

• Restrict delivery of Omron project files through email filtering — quarantine unexpected attachments with project file extensions
• Implement application whitelisting to prevent execution of files written into directories like %TEMP%, %APPDATA%, and %ProgramData%
• Use Software Restriction Policies or AppLocker to restrict where executables can run
• Train engineering staff to only open project files from trusted sources (verified vendors, direct colleagues after out-of-band confirmation)
• Implement USB device control to restrict removable media that may carry malicious project files
• Use file integrity monitoring on critical system directories and engineering workstation files

2. Patch/Upgrade Steps:

• Monitor the Omron security advisory page and CVE databases for patch availability
• Subscribe to Omron security announcements through their customer portal
• The affected product is currently unknown — identify which Omron products are in use and monitor their specific security bulletins
• Until a patch is available, apply security updates to the underlying operating system and any dependent libraries

3. Long-term Hardening:

• Segment engineering workstations (OT network) from enterprise IT network using VLANs/firewalls
• Implement the Purdue Model architecture to isolate layers 3-4 from lower OT layers
• Use least-privilege accounts for engineering software usage — do not run Omron tools with administrative privileges
• Implement rigorous backup procedures for PLC programs and engineering project files
• Consider sandboxing engineering software in virtual machines with restricted host filesystem access
• Establish a vendor security notification process to receive timely alerts from Omron
• Maintain an ICS-CERT/ISA contact for OT-specific security advisories

Threat Actor Considerations: No known threat actor campaigns or exploit-in-the-wild activity has been recorded for this CVE. The low EPSS score suggests limited real-world exploitation to date, but the unpatched status increases the risk over time.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-45792
2. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2022-45792 not currently listed)
3. Omron Product Security Advisories: https://www.ia.omron.com/product/security/ (Monitor for future advisory)
4. FIRST EPSS Score for CVE-2022-45792: https://www.first.org/epss/search?cve=CVE-2022-45792
5. NVD CWE-22 (Path Traversal) Reference: https://cwe.mitre.org/data/definitions/22.html