CVE-2023-29377

Executive Summary

CVE-2023-29377 is a relative path traversal vulnerability (CWE-23) in Softing OPC UA C++ SDK (through version 6.20) and Softing Secure Integration Server (through version 1.22). An authenticated attacker with high privileges can bypass directory-path and file-path assignment restrictions on OPC UA FileType and FileDirectoryType objects by abusing FileType rename operations, potentially leading to unauthorized file access with high confidentiality and integrity impact. No public proof-of-concept, exploitation evidence, or vendor patch is currently available.

Technical Analysis

The vulnerability resides in the Softing OPC UA C++ SDK and the Secure Integration Server, both of which implement OPC UA file-transfer functionality. In the OPC UA information model, FileType and FileDirectoryType objects are designed to expose file and directory access to OPC UA clients. Implementations typically enforce restrictions on which directory paths can be assigned to FileDirectoryType objects and which file paths can be assigned to FileType objects — these restrictions are intended to confine file operations to a permitted root or sandboxed directory.

The NVD description states that "by using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects." This indicates that the rename operation (FileType supports a MoveOrCopy method in the OPC UA specification) does not properly re-validate the destination path against the assignment restrictions. Consequently, an attacker can rename a FileType object so that its associated path resolves outside the intended sandbox, or so that a renamed FileDirectoryType object accepts a path that would normally be rejected. This is a classic relative path traversal condition (CWE-23): a canonicalization/validation check is performed on the initial path assignment but is not enforced (or is bypassed) on subsequent rename operations.

Because the vulnerability requires an authenticated OPC UA session with high privileges (PR:H) and the attack complexity is high (AC:H, likely due to timing or the need to chain rename operations), the CVSS score is 6.6. The scope is unchanged (S:U), but confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H), meaning a successful exploit can expose sensitive files, modify files, and potentially disrupt file-serving operations.

It is important to note that no public technical write-up, CVE CNA title, or exploit code was provided in the intelligence dataset. The code-level function names of the SDK's internal path-validation routines are not present in the source material and therefore are not fabricated here. The analysis above is derived strictly from the NVD description and the OPC UA information model semantics.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class (CWE-23 path traversal via rename bypass) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies an exposed Softing OPC UA endpoint — for example, a Secure Integration Server or a product built on the OPC UA C++ SDK ≤ 6.20 — reachable on the network. OPC UA typically listens on TCP port 4840. The attacker fingerprints the service (product banners, OPC UA endpoint discovery, or certificate subject) to confirm the Softing implementation and version.

2. Privilege acquisition. The attacker must first obtain a valid OPC UA session with the high privileges required to create, assign, or modify FileType / FileDirectoryType objects (PR:H). This could be achieved through legitimate administrative credentials, credential reuse, or compromise of a service account. UI interaction is not required (UI:N).

3. Triggering the flaw class. Using the OPC UA client session, the attacker creates or accesses a FileType object and manipulates its path via rename operations. Because the rename path is not re-validated against the directory/file assignment restrictions, the attacker can cause a FileType or FileDirectoryType object to reference a path outside the intended sandbox (classic relative path traversal). The attacker can then read from, write to, or move files that should be inaccessible.

4. Payload / execution method. At the vulnerability-class level, the attacker supplies crafted path strings through OPC UA file/directory methods (e.g., assignment and rename operations) to traverse to arbitrary filesystem locations. No specific method names beyond those in the NVD description (FileType, FileDirectoryType) are asserted, because the source material does not provide them.

5. Post-exploitation impact. With the path restriction bypassed, the attacker achieves high confidentiality and integrity impact: reading sensitive configuration or credential files, modifying critical files, or disrupting file operations. Availability impact (A:H) may manifest if file operations on renamed objects cause denial-of-service conditions for legitimate clients. Lateral movement and persistence are plausible if the accessed files contain credentials or executable content, though this is not confirmed by the source data.

Impact Assessment

• Confidentiality (C:H): Arbitrary file read via path traversal can expose sensitive SDK or server configuration, certificates, and possibly credentials.
• Integrity (I:H): Rename and file-write operations can alter or relocate critical files, potentially corrupting application behavior or planting malicious content.
• Availability (A:H): File operations on misassigned paths may render file-serving components unusable for legitimate users.
• Attack Vector (AV:N): Exploitable over the network via the OPC UA protocol.
• Attack Complexity (AC:H): Exploitation is non-trivial, likely requiring chained rename operations or specific object-state conditions.
• Privileges Required (PR:H): The attacker needs high-privileged OPC UA write/configuration access.
• User Interaction (UI:N): No victim user action is required.
• Scope (S:U): Impact remains within the vulnerable component's security authority.
• Blast radius: Any deployment using Softing OPC UA C++ SDK ≤ 6.20 or Secure Integration Server ≤ 1.22 is affected. Because the SDK is embedded in third-party products, the true blast radius may extend beyond Softing-branded servers. Industrial and OT environments relying on OPC UA for data integration are the primary concern. EPSS is low (0.00485, 40.6th percentile), and the CVE is not in CISA KEV, suggesting limited current exploitation activity.

Detection Guidance

Detection should focus on anomalous OPC UA file/directory operations — particularly rename (MoveOrCopy) and path-assignment requests containing traversal sequences (.., encoded variants, absolute paths) — and on file-system activity outside expected sandbox roots.

Sigma Rule

title: Softing OPC UA FileType Rename Path Traversal Attempt
id: 9f2a7c14-5b3e-4d8a-9c1f-7e6d2a4b8c10
status: experimental
description: Detects OPC UA file/directory operations containing traversal sequences or anomalous rename requests targeting Softing OPC UA services.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-29377
author: Valters IT Threat Intelligence
date: 2025-01-01
logsource:
  category: application
  product: opcua
detection:
  selection_path:
    - path|contains:
        - '..'
        - '%2e%2e'
        - '..%2f'
        - '..\\'
        - '%252e%252e'
  selection_op:
    operation|contains:
      - 'MoveOrCopy'
      - 'Rename'
      - 'SetDirectory'
      - 'SetFilePath'
  selection_target:
    - 'FileType'
    - 'FileDirectoryType'
  condition: selection_path and (selection_op or selection_target)
falsepositives:
  - Legitimate administrative file migration using relative paths
level: high

YARA Rule

rule CVE_2023_29377_Softing_OPCUA_Traversal
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects traversal patterns in OPC UA file/directory request artifacts targeting Softing OPC UA C++ SDK / Secure Integration Server (CVE-2023-29377)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-29377"
        date = "2025-01-01"
        severity = "high"

    strings:
        $opcua_move = "MoveOrCopy" ascii nocase
        $filetype   = "FileType" ascii nocase
        $filedir    = "FileDirectoryType" ascii nocase
        $trav1      = "../" ascii
        $trav2      = "..\\" ascii
        $trav3      = "%2e%2e%2f" ascii nocase
        $softing    = "Softing" ascii nocase

    condition:
        ($softing or $filetype or $filedir) and
        ($trav1 or $trav2 or $trav3) and
        $opcua_move
}

Suricata IDS Rule

alert tcp any any -> any 4840 (msg:"CVE-2023-29377 Softing OPC UA FileType Rename Path Traversal Attempt"; flow:established,to_server; content:"FileType"; nocase; content:"MoveOrCopy"; nocase; distance:0; content:".."; within:128; reference:cve,2023-29377; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-29377; classtype:attempted-user; sid:10029377; rev:1;)

Elastic Detection

process where event.category == "network" and
  network.destination.port == 4840 and
  (
    stringContains(network.protocol, "opcua") or
    stringContains(url.path, "FileType") or
    stringContains(url.path, "FileDirectoryType")
  ) and
  (
    stringContains(url.path, "..") or
    stringContains(url.path, "%2e%2e") or
    stringContains(url.path, "MoveOrCopy")
  )

Splunk SPL Query

index=network sourcetype=opcua OR sourcetype=suricata
| search dest_port=4840 ("FileType" OR "FileDirectoryType" OR "MoveOrCopy")
| regex _raw="(\.\./|\.\.\\|%2e%2e|MoveOrCopy|SetDirectory|SetFilePath)"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="opcua,softing,cve-2023-29377,">
  <rule id="100377" level="10">
    <decoded_as>json</decoded_as>
    <field name="dest_port">^4840$</field>
    <field name="opcua.operation">MoveOrCopy|Rename|SetDirectory|SetFilePath</field>
    <description>CVE-2023-29377: Softing OPC UA FileType rename/path assignment operation detected</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
  <rule id="100378" level="12">
    <decoded_as>json</decoded_as>
    <field name="opcua.path">\.\.\/|\.\.\\|%2e%2e</field>
    <description>CVE-2023-29377: Path traversal sequence in OPC UA file/directory request</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to OPC UA endpoints (default TCP 4840) using firewall/segmentation; expose only to trusted hosts.
   • Enforce least privilege on OPC UA accounts — do not grant high-privileged write/configuration roles to accounts that do not require them (the vulnerability requires PR:H).
   • Monitor and alert on FileType/FileDirectoryType rename and path-assignment operations, especially those containing traversal sequences.
   • Where feasible, disable or restrict OPC UA file-transfer functionality (FileType/FileDirectoryType objects) if not operationally required.
   • Isolate affected Softing SDK-based products in OT network segments with strict egress/ingress filtering.

2. Patch / upgrade steps:

   • No vendor patch is currently confirmed by any tracked source. Monitor the vendor (Softing) security advisories and CVE listings for an official fix and updated SDK/server versions.
   • Inventory all products embedding Softing OPC UA C++ SDK ≤ 6.20, since the SDK may be present in third-party applications.
   • When a patched SDK/Secure Integration Server release becomes available, plan upgrade windows for all affected assets.

3. Long-term hardening:

   • Apply OPC UA security best practices: enable message signing/encryption, enforce certificate-based authentication, and use hardened endpoint policies.
   • Implement application allowlisting and file-integrity monitoring on hosts running Softing components.
   • Conduct regular vulnerability scanning that includes embedded SDK versions, not just product banners.
   • Adopt network detection rules (Sigma/YARA/Suricata/Elastic/Splunk/Wazuh as above) and tune them to reduce false positives from legitimate administrative file operations.
   • Track CISA KEV and vendor advisories for status changes; if exploitation emerges, elevate to emergency patching.

References

• NVD — CVE-2023-29377: https://nvd.nist.gov/vuln/detail/CVE-2023-29377
• MITRE CWE-23 (Relative Path Traversal): https://cwe.mitre.org/data/definitions/23.html
• OPC UA Specification (File Transfer / FileType / FileDirectoryType): https://reference.opcfoundation.org/
• Softing Security Advisories: https://softing.com/ (monitor vendor security page for product advisories)
• CISA Known Exploited Vulnerabilities Catalog (currently NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / in-the-wild exploitation: No public PoC, exploit code, or evidence of active exploitation was available in the provided intelligence. CVE is not listed in CISA KEV, and EPSS is low (0.00485). Exploitation status should be re-evaluated as new intelligence emerges.