CVE-2023-6132

Executive Summary

CVE-2023-6132 is a high-severity vulnerability in AVEVA Edge, a human-machine interface (HMI) and supervisory control and data acquisition (SCADA) software. The flaw allows an attacker with local file system access to achieve arbitrary code execution and privilege escalation by tricking the application into loading an untrusted Dynamic Link Library (DLL). This is a classic untrusted search path vulnerability (CWE-427). The CVSS score of 7.3 reflects the high impact on confidentiality, integrity, and availability, though the attack vector is local and requires user interaction. No public proof-of-concept (PoC) or patch details are currently available, but the risk is significant for industrial control system (ICS) environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Windows-based SCADA/HMI application (AVEVA Edge). The supply chain risk is limited to the distribution of the AVEVA Edge installer itself, which could be tampered with to include a malicious DLL.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (HIGH)
• Attack Vector (AV): Local (L) – The attacker must have access to the file system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs basic user privileges.
• User Interaction (UI): Required (R) – The victim must perform an action (e.g., open a project file).
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Full system denial of service possible.

Threat Level: HIGH. While the attack vector is local, in many ICS environments, local access can be obtained via USB drops, phishing, or compromised peripheral devices. The lack of a patch makes this a critical risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability lies in how AVEVA Edge resolves and loads DLLs. When the application starts or opens a project, it searches for required DLLs in a specific order, often including the current working directory or the directory from which the application was launched. An attacker can place a malicious DLL (e.g., version.dll, dbghelp.dll, or a custom-named DLL) in a directory that AVEVA Edge will search before the system directory. When the application loads the DLL, the attacker's code executes with the privileges of the AVEVA Edge process, which typically runs with high integrity (often SYSTEM or Administrator).

The attack flow:

1. Attacker gains local access (e.g., via a USB drive or compromised account).
2. Attacker places a malicious DLL in a directory that AVEVA Edge will search (e.g., the project directory, the user's temp folder, or the application's install directory).
3. Victim launches AVEVA Edge or opens a project file from the attacker-controlled directory.
4. AVEVA Edge loads the malicious DLL instead of the legitimate one.
5. The DLL executes arbitrary code, escalating privileges or exfiltrating data.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable behavior is the use of insecure DLL loading functions like LoadLibrary or LoadLibraryEx without specifying a full path or using safe search order flags (e.g., LOAD_LIBRARY_SEARCH_SYSTEM32). A patched version would likely:

• Use absolute paths for all DLLs.
• Use SetDllDirectory to remove the current directory from the search path.
• Use LoadLibraryEx with LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR or LOAD_LIBRARY_SEARCH_SYSTEM32.

Vulnerable Code (Conceptual):

HMODULE hMod = LoadLibraryA("helper.dll"); // Searches current directory first

Patched Code (Conceptual):

SetDllDirectory(L""); // Remove current directory from search path
HMODULE hMod = LoadLibraryExA("C:\\Program Files\\AVEVA\\Edge\\helper.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• Windows 10/11 VM with AVEVA Edge installed (vulnerable version).
• Attacker VM (Kali Linux or Windows) with a compiled malicious DLL.

Steps:

1. Create a malicious DLL that spawns a reverse shell or adds a user to the Administrators group.
2. Place the DLL in a directory that AVEVA Edge will search (e.g., C:\Users\victim\Documents\AVEVA\Projects\).
3. Trick the victim into opening a project file from that directory (e.g., via email or USB).
4. When AVEVA Edge loads the project, it loads the malicious DLL, executing the payload.

Example Malicious DLL (C++):

#include <windows.h>
#pragma comment(lib, "ws2_32.lib")

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Reverse shell or privilege escalation code here
        system("net user attacker Password123! /add && net localgroup Administrators attacker /add");
    }
    return TRUE;
}

Blue Team (Defense & Detection)

Defensive Measures:

• Monitor for DLL load events from non-standard directories.
• Use AppLocker or Windows Defender Application Control (WDAC) to block untrusted DLLs.
• Enable Safe DLL Search Mode (registry key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode).
• Restrict write access to AVEVA Edge installation and project directories.

Detection:

• Monitor for LoadLibrary calls from AVEVA Edge to DLLs in user-writable paths.
• Alert on new DLLs appearing in the AVEVA Edge process directory.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – replace with actual hashes if discovered)
  • malicious.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Anomalies:
  • AVEVA Edge (AvevaEdge.exe) loading DLLs from %TEMP%, %USERPROFILE%\Documents, or C:\Users\Public.
• Network Connections:
  • Outbound connections from AvevaEdge.exe to unknown IPs (if reverse shell is used).
• Registry Changes:
  • New entries under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence.

Detection Engineering

YARA Rule

rule CVE_2023_6132_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting AVEVA Edge DLL hijacking"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-6132"
    strings:
        $s1 = "AVEVA Edge" nocase
        $s2 = "LoadLibrary" nocase
        $s3 = "helper.dll" nocase
        $s4 = "version.dll" nocase
    condition:
        uint16(0) == 0x5A4D and // MZ header
        (1 of ($s1, $s2) or all of ($s3, $s4))
}

Sigma Rule

title: AVEVA Edge Suspicious DLL Load
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AVEVA Edge loading DLLs from non-standard directories
author: Valters IT
date: 2024-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\AvevaEdge.exe'
        CommandLine|contains: 'LoadLibrary'
    filter:
        CommandLine|contains:
            - 'C:\Windows\System32\'
            - 'C:\Program Files\AVEVA\'
    condition: selection and not filter
falsepositives:
    - Legitimate DLL loading from custom project directories
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2023-6132 AVEVA Edge Potential DLL Hijack Outbound"; flow:to_server,established; content:"AVEVA Edge"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect AVEVA Edge systems from untrusted networks.
2. Restrict file system access: Use Group Policy to prevent users from writing to directories where AVEVA Edge searches for DLLs.
3. Enable Safe DLL Search Mode: Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1.
4. Monitor for exploitation: Deploy the YARA and Sigma rules above.

Long-Term Fix:

• Apply the official patch from AVEVA when released.
• Upgrade to a patched version of AVEVA Edge.
• Implement application whitelisting (e.g., WDAC) to only allow signed DLLs.

Workaround:

• Use a custom manifest file for AVEVA Edge that specifies exact DLL paths.

Valters IT
DevSecOps & Cyber Threat Intelligence