Stored Cross-Site Scripting in Trace File Import in SIMATIC Process Historian

Executive Summary

This vulnerability involves affected Siemens SIMATIC devices not properly sanitizing comment fields in imported trace files before displaying them. An attacker could trick an authorized user with 'Read diagnostics' rights into importing a malicious trace file. This could lead to attacker-controlled JavaScript executing in the user's browser, allowing unauthorized PLC operations within the user's permission scope.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improperly sanitized comment fields in trace files. Detection requires monitoring for suspicious trace file imports or unusual JavaScript execution in browser sessions. Check web server logs for unexpected trace file uploads or unauthorized PLC operations. Use network monitoring tools to detect unusual outbound connections from affected devices.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to perform unauthorized PLC operations through the web server within the scope of an authorized user's permissions. This might lead to unauthorized changes in industrial control systems, potentially disrupting operations or causing safety issues. The high CVSS scores (9.6 for v3.1 and 9.4 for v4.0) indicate significant risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data processed by affected devices, potentially violating GDPR's data protection requirements and HIPAA's security rules for protected health information. The ability to execute malicious code in a user's browser session may result in data breaches or unauthorized modifications, undermining compliance with these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the 'Read diagnostics' function right for all users. Disable trace file import functionality if possible. Ensure all users accessing affected systems use updated browsers with strict security settings. Monitor network traffic for unauthorized PLC operations and isolate affected devices from critical systems until patches are available.

Useful 0 Not Useful 0