« Back to all blog posts

OPC UA XML External Entity (XXE) Exploit

20.06.2018


OPC Foundation (OPCF) has announced a Security Bulletin (CVE-2018-12585) on June 20, 2018 concerning a vulnerability in the OPC UA Java Stack of OPC Foundation:

”… that allowed remote attackers to send carefully constructed requests that caused an OPC UA [server] to access unauthorized sites and potentially causing a denial of service.”

The issue is in fact a well know vulnerability in Java (and other environments), related to XML External Entities.

Prosys OPC UA products affected

The vulnerability affects directly:

  • All applications built with Prosys OPC UA Java SDK 3.1.2 and earlier
  • Prosys OPC UA Client 3.0.0 and earlier
  • Prosys OPC UA Simulation Server 3.0.0 and earlier
  • Prosys OPC UA Modbus Server 1.2.2 and earlier
  • Prosys OPC UA Historian 1.0.0

Fixed products

The issue is now fixed in Prosys OPC UA Java SDK 3.1.4, UA Client 3.1.4, Simulation Server 3.1.4 and Modbus Server 1.2.4 and we encourage everyone to update to these versions. Prosys OPC UA Historian will be updated later, respectively.

Unified Automation products affected

Although this CVE concerns the Java Stack only, a similar CVE (CVE-2017-12069) was already published previously for .NET products.

Unified Automation has released a restricted security bulletin regarding the issue. Please, find more information how to access this from the Unified Automation website.

Fixing the issue with older library versions

The issue is related to a common XXE vulnerability in Java XML components. It has now been fixed in the Java Stack and the respective fix can also be applied to application code directly, if it still needs to be built with an earlier version of the Java Stack and Java SDK. Since the fix is concerning the objects of the XmlFactoryCache and the respective objects are also available via getter methods, you can apply the same fix on these objects (‘getDocumentFactoryBuilder().setAttribute()’, etc.)

Note that the vulnerability cannot be fixed in application binaries only.

Note that the fix requires also a recent Java Virtual Machine, namely Java 7 update 67, Java 8 update 20, or above. Also, it depends on the actual XML parsers used by the JVM. The fix assumes Apache Xerces, which is the default in Oracle JDK and OpenJDK. If you have a custom environment, you will need to check the proer ways to overcome the issue.

More security information

You will find the currently announced security issues in Prosys OPC products from the blog under the #Security tag.

You might also like to read about the OPC UA Security Process of the OPC Foundation.

Jouni Aro

Jouni Aro

Chief Technology Officer

Email: jouni.aro@prosysopc.com

Expertise and responsibility areas: OPC & OPC UA product development, project work and customer support

Tags: OPC UA, Security

comments powered by Disqus

About Prosys

Prosys is a leading provider of professional OPC software and services with over 10 years of experience in the field. OPC and OPC UA (Unified Architecture) are communications standards used especially by industrial and high-tech companies.

Read more about us »

Newest blog posts

OPC UA Getting Real and Real-time - Report from OPC Day Finland 2018

OPC UA is getting popular in real-world installations and also going towards real-time with the latest announcements about support for field level.

Getting Started with OPC UA (Videos)

Watch the short videos to get a quick overview of how to get started with OPC UA end-user products or with development. They are represented by Jouni Aro, the CTO of Prosys OPC.

OPC UA Buffer Overflow Exploit

Security vulnerability

View all blog posts »