CVE-2023-39479

Executive Summary

CVE-2023-39479 is a directory creation vulnerability in Softing Secure Integration Server's OPC UA Gateway. The flaw allows an authenticated attacker to bypass authentication mechanisms and create arbitrary directories on the filesystem via the FileDirectory OPC UA Objects. While the CVSS score is 6.6 (Medium), the ability to bypass authentication and create directories can be chained with other vulnerabilities to achieve remote code execution as root. No public exploit code or patch is currently available, making this a high-priority risk for industrial environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a proprietary industrial software product (Softing Secure Integration Server) used in OT/ICS environments.

CVSS Breakdown & Threat Level

• CVSS Score: 6.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (but authentication bypass exists)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: High

The threat level is elevated due to the authentication bypass and potential for chaining with other exploits to achieve root-level code execution.

Deep Dive & Mechanics

The vulnerability resides in the handling of FileDirectory OPC UA Objects within Softing Secure Integration Server. The OPC UA protocol allows clients to browse and manipulate directory structures. Due to insufficient access controls, an authenticated attacker can send crafted OPC UA requests to create directories anywhere on the filesystem, bypassing the intended authentication checks.

The specific flaw (ZDI-CAN-20548) stems from improper validation of user permissions when processing FileDirectory operations. The server does not enforce proper authorization, allowing a low-privileged user to create directories in sensitive locations (e.g., /etc, /var/www). This directory creation can be used to stage malicious files or trigger other vulnerabilities (e.g., path traversal, symlink attacks) leading to arbitrary code execution as root.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resides in the OPC UA stack's file handling module. A hypothetical patch would enforce proper authorization checks before allowing directory creation, such as verifying the user's role and restricting write operations to allowed paths.

Vulnerable Code (Conceptual):

// No authorization check before creating directory
if (opcua_create_directory(path) == SUCCESS) {
    // Directory created without verifying user permissions
}

Patched Code (Conceptual):

// Authorization check added
if (user_has_permission(user, WRITE_FILESYSTEM) && is_path_allowed(path)) {
    if (opcua_create_directory(path) == SUCCESS) {
        // Directory created only for authorized users
    }
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: Access to a Softing Secure Integration Server instance with OPC UA client capabilities.
2. Authentication Bypass: Use a low-privileged account or exploit the authentication bypass (details not public).
3. Exploit Steps:
   • Connect to the OPC UA endpoint.
   • Send a crafted CreateDirectory request to a sensitive path (e.g., /tmp/exploit).
   • Verify directory creation via filesystem access.
   • Chain with other vulnerabilities (e.g., path traversal) to write a malicious script or binary.
   • Execute the payload to gain root access.

Example OPC UA Request (Conceptual):

from opcua import Client

client = Client("opc.tcp://target:4840")
client.connect()
# Bypass authentication (if needed)
# Create directory
obj = client.get_node("ns=2;s=FileDirectory")
obj.call_method("CreateDirectory", "/tmp/exploit")
client.disconnect()

Blue Team

1. Detection: Monitor for unusual OPC UA CreateDirectory calls to sensitive paths.
2. Honeypot: Deploy a fake Softing server to capture exploitation attempts.
3. Network Segmentation: Restrict OPC UA traffic to trusted IPs only.
4. Logging: Enable detailed OPC UA audit logs and monitor for CreateDirectory operations.

Indicators of Compromise (IOCs)

• Network: OPC UA packets with CreateDirectory method calls to paths like /tmp, /etc, /var.
• Filesystem: Unexpected directories created in sensitive locations (e.g., /tmp/exploit, /var/www/html/backdoor).
• Process: Unusual child processes spawned by the Softing server (e.g., shell commands).
• Logs: OPC UA audit logs showing CreateDirectory operations from low-privileged users.

Detection Engineering

YARA Rule

rule CVE_2023_39479_Softing_DirCreate {
    meta:
        description = "Detects exploitation attempts of CVE-2023-39479 via OPC UA directory creation"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2023-39479"
    strings:
        $opcua_create = "CreateDirectory" ascii wide nocase
        $sensitive_path = "/tmp" ascii wide nocase or "/etc" ascii wide nocase or "/var" ascii wide nocase
    condition:
        $opcua_create and $sensitive_path
}

Sigma Rule

title: CVE-2023-39479 - Softing OPC UA Directory Creation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects OPC UA CreateDirectory calls to sensitive paths
author: Valters IT
logsource:
    product: windows
    service: opcua
detection:
    selection:
        EventID: 4104  # OPC UA audit event
        MethodName: 'CreateDirectory'
        TargetPath|contains:
            - '/tmp'
            - '/etc'
            - '/var'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert tcp any any -> any 4840 (msg:"CVE-2023-39479 - Softing OPC UA Directory Creation Attempt"; flow:to_server,established; content:"|00 00 00 00|CreateDirectory"; nocase; content:"/tmp|00|"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable OPC UA FileDirectory functionality if not required.
2. Network: Restrict OPC UA access to trusted IPs via firewall rules.
3. Authentication: Enforce strong authentication and monitor for bypass attempts.
4. Patch: Contact Softing for a patch or apply vendor-supplied workarounds.
5. Monitoring: Deploy the provided detection rules to identify exploitation attempts.
6. Segregation: Isolate the Softing server in a separate VLAN with strict access controls.

Valters IT