CVE-2024-27768

Executive Summary

CVE-2024-27768 is a critical path traversal vulnerability (CWE-22) affecting Unitronics Unistream Unilogic versions prior to 1.35.227. This flaw allows an unauthenticated attacker to traverse directories on the target system, potentially leading to remote code execution (RCE). With a CVSS score of 9.8, the vulnerability is remotely exploitable without authentication or user interaction, posing a severe risk to industrial control systems (ICS) and operational technology (OT) environments. The vendor has released a patched version (1.35.227), but no public proof-of-concept (PoC) or exploit code has been identified at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects proprietary Unitronics firmware and software for their Unistream PLC series.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the lack of authentication required, low complexity, and potential for full system compromise. In OT environments, exploitation could lead to disruption of industrial processes, data exfiltration, or lateral movement into critical infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the Unilogic runtime software used by Unitronics Unistream PLCs. A path traversal flaw (CWE-22) exists in the handling of file paths, allowing an attacker to use sequences like ../ to escape restricted directories. This can be exploited via crafted HTTP requests or other network protocols supported by the device.

The root cause is insufficient validation of user-supplied input when constructing file paths. By sending a specially crafted request, an attacker can read arbitrary files (e.g., configuration files, credentials) or write files to arbitrary locations, potentially leading to remote code execution if the attacker can overwrite executable files or scripts.

The vulnerability is exploitable over the network without authentication, making it a prime target for initial access in OT networks. Shodan dorks reveal that many Unistream devices are exposed on the internet, increasing the attack surface.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.35.227):

// Pseudocode example of vulnerable path handling
char path[256];
snprintf(path, sizeof(path), "/data/%s", user_input);
FILE *file = fopen(path, "r");
if (file) {
    // Process file
}

In this example, user_input is not sanitized, allowing ../../etc/passwd to read sensitive files.

Patched Code (1.35.227):

// Pseudocode example of patched path handling
char path[256];
if (strstr(user_input, "..") != NULL) {
    // Reject input
    return -1;
}
snprintf(path, sizeof(path), "/data/%s", user_input);
FILE *file = fopen(path, "r");
if (file) {
    // Process file
}

The patch adds a check for .. sequences, preventing directory traversal. However, more robust validation (e.g., canonicalization) is recommended.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a Unitronics Unistream PLC with Unilogic version 1.34.0 (vulnerable).
2. Ensure the device is network-accessible (e.g., on a local VM or physical hardware).
3. Use a tool like curl or a custom Python script to send malicious requests.

Exploitation Steps:

• Read Arbitrary File:

  curl "http://<target_ip>/../../etc/passwd"
  

  This may return the contents of /etc/passwd if the web server is vulnerable.

• Write Arbitrary File (Potential RCE):

  curl -X POST "http://<target_ip>/../../tmp/evil.sh" -d "malicious content"
  

  If the device allows file uploads via path traversal, an attacker could overwrite a startup script.

Note: No public exploit code is available. The above examples are conceptual.

Blue Team

Detection:

• Monitor for HTTP requests containing ../ or ..%2f patterns.
• Alert on attempts to access sensitive paths like /etc/passwd, /windows/system32, or /proc/self/environ.
• Use network segmentation to limit exposure of PLCs to the internet.

Hunting:

• Search logs for unusual file access patterns or failed authentication attempts followed by path traversal strings.
• Check for unexpected file modifications on the PLC (e.g., new scripts in /tmp or /var).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with ../ or ..%2f in the URI.
  • Connections to port 20256 (default Unistream port) from unexpected IPs.
• File IOCs:
  • Unauthorized files in /tmp, /var, or /etc on the PLC.
  • Modified configuration files (e.g., unilogic.conf).
• System IOCs:
  • Unexpected processes or services running on the PLC.
  • Changes to user accounts or credentials.

Detection Engineering

YARA Rule

rule CVE_2024_27768_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Unitronics Unistream Unilogic"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-27768"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/windows/system32"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-27768 Path Traversal Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts against Unitronics Unistream devices
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate use of dots in paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27768 Path Traversal Attempt"; flow:to_server; content:"../"; http_uri; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-27768 Path Traversal Attempt (URL Encoded)"; flow:to_server; content:"%2e%2e%2f"; http_uri; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Unilogic to version 1.35.227 or later.
2. Network Segmentation: Isolate PLCs from the internet and untrusted networks. Use firewalls to restrict access to port 20256.
3. Access Control: Implement strong authentication and disable unnecessary services.

Long-term Measures:

• Conduct regular vulnerability assessments on OT assets.
• Monitor for Shodan exposure and reduce internet-facing devices.
• Implement input validation and canonicalization in custom applications.

Workarounds (if patching is not possible):

• Use a web application firewall (WAF) to block path traversal patterns.
• Restrict file system permissions on the PLC to prevent writes to critical directories.

Valters IT