Deserialization Flaw in Snap7 Library

Executive Summary

This vulnerability is a flaw in the davenardella snap7 software up to version 1.4.3, specifically in the TS7Worker::PerformFunctionRead function within the ReadVar Request Handler component. It involves a manipulation that causes deserialization, which means that crafted input can be used to exploit the way data is processed. The attack requires access to the local network, and an exploit has already been published.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker with local network access to manipulate the deserialization process in the affected software. This could potentially lead to unauthorized actions or compromise of the system running the vulnerable component. The CVSS v3.1 score of 6.3 indicates a medium severity impact, including possible impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a stack-based buffer overflow in the Snap7 library's TS7Worker::PerformFunctionRead function, triggered by a maliciously crafted ReadVar request containing multiple items. Detection can focus on monitoring network traffic for suspicious ReadVar requests with unusually large or numerous items.

Since the Snap7 project provides utility programs such as clientdemo and serverdemo for testing PLC connections and monitoring HMI interactions, these tools can be used to simulate or observe ReadVar requests.

To detect exploitation attempts, you can capture network traffic on the local network segment where Snap7 servers operate and filter for ISO-TCP communication to Siemens S7 PLCs, looking for ReadVar requests with abnormal payload sizes or counts.

• Use packet capture tools like tcpdump or Wireshark to monitor traffic on the relevant network interface.
• Example tcpdump command to capture traffic on port 102 (ISO-on-TCP used by Snap7): tcpdump -i <interface> port 102 -w snap7_traffic.pcap
• Analyze captured packets in Wireshark, filtering for ReadVar requests and inspecting the number and size of items in the requests.
• Use or adapt the provided proof-of-concept (PoC) code to generate test requests and observe server behavior for signs of overflow or crashes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the Snap7 server to trusted hosts only, since the attack requires local network access.

Network segmentation and firewall rules should be applied to limit exposure of the Snap7 service (typically on ISO-TCP port 102) to untrusted or external networks.

Monitor Snap7 server logs and network traffic for suspicious ReadVar requests with large or numerous items that could trigger the overflow.

If possible, temporarily disable or restrict the use of the vulnerable ReadVar functionality until a patch or update is available.

Since the project has not yet responded with a fix, consider applying additional application-level protections such as input validation or sandboxing the Snap7 server process.

Useful 0 Not Useful 0