OPC UA XML External Entity (XXE) Exploit

OPC Foundation (OPCF) has announced a Security Bulletin (CVE-2018-12585) on June 20, 2018 concerning a vulnerability in the OPC UA Java Stack of OPC Foundation:

"… that allowed remote attackers to send carefully constructed requests that caused an OPC UA [server] to access unauthorized sites and potentially causing a denial of service."

The issue is in fact a well know vulnerability in Java (and other environments), related to XML External Entities.

Prosys OPC UA products affected

The vulnerability affects directly:

• All applications built with Prosys OPC UA Java SDK 3.1.2 and earlier
• Prosys OPC UA Client 3.0.0 and earlier
• Prosys OPC UA Simulation Server 3.0.0 and earlier
• Prosys OPC UA Modbus Server 1.2.2 and earlier
• Prosys OPC UA Historian 1.0.0

Fixed products

The issue is now fixed in Prosys OPC UA Java SDK 3.1.4, UA Client 3.1.4, Simulation Server 3.1.4 and Modbus Server 1.2.4 and we encourage everyone to update to these versions. Prosys OPC UA Historian will be updated later, respectively.

Unified Automation products affected

Although this CVE concerns the Java Stack only, a similar CVE (CVE-2017-12069) was already published previously for .NET products.

Unified Automation has released a restricted security bulletin regarding the issue. Please, find more information how to access this from the Unified Automation website.

Fixing the issue with older library versions

The issue is related to a common XXE vulnerability in Java XML components. It has now been fixed in the Java Stack and the respective fix can also be applied to application code directly, if it still needs to be built with an earlier version of the Java Stack and Java SDK. Since the fix is concerning the objects of the XmlFactoryCache and the respective objects are also available via getter methods, you can apply the same fix on these objects ('getDocumentFactoryBuilder().setAttribute()', etc.)

Note that the vulnerability cannot be fixed in application binaries only.

Note that the fix requires also a recent Java Virtual Machine, namely Java 7 update 67, Java 8 update 20, or above. Also, it depends on the actual XML parsers used by the JVM. The fix assumes Apache Xerces, which is the default in Oracle JDK and OpenJDK. If you have a custom environment, you will need to check the proper ways to overcome the issue.

More security information

You will find the currently announced security issues in Prosys OPC products from the blog under the Security tag.

You might also like to read about the OPC UA Security Process of the OPC Foundation.