CVE-2024-3467

Executive Summary

CVE-2024-3467 is a vulnerability in AVEVA PI Asset Framework (AF) Client that allows an attacker to execute arbitrary code on the PI System Explorer environment. The attack vector relies on social engineering to trick an interactive user into importing a malicious XML file. Once imported, the XML can trigger code execution under the privileges of the victim user. This vulnerability is particularly dangerous in industrial control system (ICS) environments where PI System Explorer is used for asset management and data visualization. No public proof-of-concept (PoC) or exploit code has been released, and the CVSS score is currently 0.0, indicating incomplete assessment. The EPSS score is 0.0%, suggesting low exploitation likelihood at this time, but the risk remains due to the potential for lateral movement and privilege escalation within OT networks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Local (requires user interaction)
• Attack Complexity (AC): Low
• Privileges Required (PR): None (attacker does not need prior access)
• User Interaction (UI): Required (social engineering)
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Threat Level: High (due to potential for full system compromise in OT environments)

Deep Dive & Mechanics

The vulnerability resides in the XML parsing functionality of AVEVA PI AF Client. When a user imports an XML file (e.g., via drag-and-drop or file open dialog), the client processes the XML without proper validation. An attacker can craft a malicious XML file that includes external entities or embedded scripts. Upon import, the XML parser may execute these entities, leading to arbitrary code execution. The attack requires social engineering to convince the user to import the file, such as via phishing emails or malicious attachments disguised as legitimate configuration files.

The PI System Explorer environment runs with the privileges of the interactive user, so successful exploitation grants the attacker the same level of access. This can lead to data exfiltration, installation of backdoors, or disruption of industrial processes.

Vulnerable vs. Patched Code

No patched version has been released. The vulnerable code is in the XML import functionality of PI AF Client. A secure implementation would sanitize XML input, disable external entity processing, and validate file signatures before import.

Vulnerable Code (Conceptual):

# Vulnerable XML parsing
import xml.etree.ElementTree as ET
tree = ET.parse(user_provided_file)
root = tree.getroot()
# Process XML without disabling external entities

Patched Code (Conceptual):

# Secure XML parsing
from defusedxml import ElementTree as ET
tree = ET.parse(user_provided_file)
root = tree.getroot()
# Use defusedxml to prevent XXE and code injection

Exploitation & Lab Setup

Red Team

1. Craft Malicious XML: Create an XML file with embedded script or external entity that executes a payload.
2. Social Engineering: Deliver the file via phishing email or malicious download link.
3. Trigger Import: Convince the user to import the file into PI System Explorer.
4. Execute Payload: The XML parser executes the payload, granting code execution.

Example Malicious XML:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///c:/windows/system32/cmd.exe">
]>
<root>&xxe;</root>

Blue Team

1. Monitor XML Imports: Log all XML file imports in PI System Explorer.
2. User Awareness: Train users to avoid importing untrusted XML files.
3. Network Segmentation: Restrict PI System Explorer access to trusted hosts.
4. Endpoint Protection: Deploy EDR solutions to detect anomalous process execution.

Indicators of Compromise (IOCs)

• File Hashes: SHA256 of known malicious XML samples (none public yet)
• Network Indicators: Outbound connections from PI System Explorer to unknown IPs
• Process Anomalies: Unexpected child processes spawned by PI System Explorer (e.g., cmd.exe, powershell.exe)
• Registry Changes: Modifications to AVEVA registry keys
• File System: Creation of suspicious files in %TEMP% or %APPDATA%

Detection Engineering

YARA Rule

rule CVE_2024_3467_Malicious_XML {
    meta:
        description = "Detects malicious XML files targeting AVEVA PI AF Client"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3467"
    strings:
        $xml_decl = "<?xml version="
        $entity = "<!ENTITY"
        $xxe = "SYSTEM"
        $script = "<script>"
    condition:
        $xml_decl and ($entity or $xxe or $script)
}

Sigma Rule

title: AVEVA PI AF Client Malicious XML Import
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects import of XML files with suspicious content in PI System Explorer
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        Image: '*PI System Explorer*'
        TargetFilename: '*.xml'
    condition: selection
falsepositives:
    - Legitimate XML imports from trusted sources
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3467 AVEVA PI AF Client Malicious XML Download"; flow:to_server,established; content:"<?xml"; nocase; content:"<!ENTITY"; nocase; content:"SYSTEM"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Vendor Patch: Await official patch from AVEVA. Monitor their security advisory page.
2. User Training: Educate users on social engineering risks and safe XML handling.
3. Input Validation: Implement strict XML validation and disable external entities.
4. Application Whitelisting: Restrict execution of PI System Explorer to authorized users.
5. Network Controls: Block outbound connections from PI System Explorer to untrusted hosts.
6. Backup & Recovery: Maintain offline backups of critical PI AF data.

Valters IT
Securing Industrial Environments