Cross-site Scripting in Web Server Enables Arbitrary JavaScript Execution

Executive Summary

[{'type': 'paragraph', 'content': "This vulnerability is a Cross-site Scripting (XSS) issue classified as CWE-79, found in Schneider Electric's Modicon Controllers M241, M251, M258, and LMC058 products. It allows authenticated attackers to inject malicious JavaScript code that executes in a victim's browser when the victim hovers over a specially crafted element on a compromised web server."}, {'type': 'paragraph', 'content': "The attack requires the attacker to have some level of authentication and involves user interaction (hovering over the malicious element). The vulnerability can lead to arbitrary code execution within the victim's browser."}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to execute arbitrary JavaScript code in your browser, potentially leading to account takeover or unauthorized actions performed in your browser context.

Since the affected devices are Programmable Logic Controllers used in performance-demanding applications, exploitation could compromise the integrity and confidentiality of control systems, possibly affecting operational processes.

The vulnerability has a medium severity score (CVSS v4.0 base score of 5.1) and requires low privileges and user interaction, meaning it is moderately easy to exploit if the attacker is authenticated.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves Cross-site Scripting (CWE-79) in Schneider Electric Modicon Controllers M241, M251, M258, and LMC058, which allows authenticated attackers to execute arbitrary JavaScript when a victim interacts with a malicious element on the web server.

Detection involves identifying if your system is running affected firmware versions (prior to 5.4.13.12 for M241 and M251, and all versions for M258 and LMC058).

While specific commands are not provided in the available resources, general detection steps include:

• Checking the firmware version of your Modicon controllers to confirm if they are vulnerable.
• Monitoring HTTP/HTTPS traffic to and from the controllers for suspicious payloads or unusual JavaScript injections.
• Using web vulnerability scanners or manual testing to attempt XSS payload injection on the web interface of the controllers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps recommended by Schneider Electric include:

• Update the firmware of affected Modicon M241 and M251 controllers to version 5.4.13.12 or later using EcoStruxure™ Machine Expert software version 2.5.0.1.
• If patching is not immediately possible, operate controllers in protected environments with no exposure to public or untrusted networks.
• Enforce user management and strong password policies.
• Disable the webserver on the controllers when it is not in use.
• Use encrypted communication channels.
• Implement network segmentation and firewalls to block unauthorized access to HTTP (port 80) and HTTPS (port 443).
• Employ VPN tunnels for remote access.
• Follow product-specific hardening guidelines as per Schneider Electric’s cybersecurity documentation.

Useful 0 Not Useful 0