OPC UA XML External Entity (XXE) Exploit
”… that allowed remote attackers to send carefully constructed requests that caused an OPC UA [server] to access unauthorized sites and potentially causing a denial of service.”
The issue is in fact a well know vulnerability in Java (and other environments), related to XML External Entities.
Prosys OPC UA products affected
The vulnerability affects directly:
- All applications built with Prosys OPC UA Java SDK 3.1.2 and earlier
- Prosys OPC UA Client 3.0.0 and earlier
- Prosys OPC UA Simulation Server 3.0.0 and earlier
- Prosys OPC UA Modbus Server 1.2.2 and earlier
- Prosys OPC UA Historian 1.0.0
The issue is now fixed in Prosys OPC UA Java SDK 3.1.4, UA Client 3.1.4, Simulation Server 3.1.4 and Modbus Server 1.2.4 and we encourage everyone to update to these versions. Prosys OPC UA Historian will be updated later, respectively.
Unified Automation products affected
Although this CVE concerns the Java Stack only, a similar CVE (CVE-2017-12069) was already published previously for .NET products.
Unified Automation has released a restricted security bulletin regarding the issue. Please, find more information how to access this from the Unified Automation website.
Fixing the issue with older library versions
The issue is related to a common XXE vulnerability in Java XML components. It has now been fixed in the Java Stack and the respective fix can also be applied to application code directly, if it still needs to be built with an earlier version of the Java Stack and Java SDK. Since the fix is concerning the objects of the XmlFactoryCache and the respective objects are also available via getter methods, you can apply the same fix on these objects (‘getDocumentFactoryBuilder().setAttribute()’, etc.)
Note that the vulnerability cannot be fixed in application binaries only.
Note that the fix requires also a recent Java Virtual Machine, namely Java 7 update 67, Java 8 update 20, or above. Also, it depends on the actual XML parsers used by the JVM. The fix assumes Apache Xerces, which is the default in Oracle JDK and OpenJDK. If you have a custom environment, you will need to check the proer ways to overcome the issue.
More security information
You will find the currently announced security issues in Prosys OPC products from the blog under the #Security tag.
You might also like to read about the OPC UA Security Process of the OPC Foundation.
Chief Technology Officer
Expertise and responsibility areas: OPC & OPC UA product development, project work and customer support
Prosys is a leading provider of professional OPC software and services with over 10 years of experience in the field. OPC and OPC UA (Unified Architecture) are communications standards used especially by industrial and high-tech companies.
Newest blog posts
OPC UA is getting popular in real-world installations and also going towards real-time with the latest announcements about support for field level.
Watch the short videos to get a quick overview of how to get started with OPC UA end-user products or with development. They are represented by Jouni Aro, the CTO of Prosys OPC.