ICSA-24-149-01: Campbell Scientific CSI Web Server

Summary

Successful exploitation of these vulnerabilities could allow an attacker to download files and decode stored passwords. CVE-2024-5433: The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to. CVE-2024-5434: The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-24-149-01
Status: Final · version 1
Initial release: 2024-05-28
Last revised: 2024-05-28
Vendor: Campbell Scientific
Critical infrastructure sectors: Energy, Food and Agriculture, Water and Wastewater, and Transportation Systems
Deployed: Worldwide
Vendor headquarters: United States

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Credit: Patrick K. Sheehan, Grant Hume, Donald Macary

Affected products (2)

Campbell Scientific CSI Web Server — <=1.6
RTMC Pro — <=5.0

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2024-5434	CWE-261 Weak Encoding for Password	5.7 Medium	The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access. Mitigation: Campbell Scientific recommends users to update to the version.For user of CSI Web Server update to the most recent CSI Web Server 1.x patch ↗ Vendor fix: For users of RTMC Pro 5 update to the most recent RTMC Pro 5.x patch ↗ Vendor fix: For users of RTMC Pro 4 update to the most recent RTMC Pro 4.x patch. ↗ Affected, fixed & timeline Affected: Campbell Scientific CSI Web Server <=1.6 RTMC Pro <=5.0 Mitigation: Contact Campbell Scientific for more details.
CVE-2024-5433	CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	5.3 Medium	The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to. Mitigation: Campbell Scientific recommends users to update to the version.For user of CSI Web Server update to the most recent CSI Web Server 1.x patch ↗ Vendor fix: For users of RTMC Pro 5 update to the most recent RTMC Pro 5.x patch ↗ Vendor fix: For users of RTMC Pro 4 update to the most recent RTMC Pro 4.x patch. ↗ Affected, fixed & timeline Affected: Campbell Scientific CSI Web Server <=1.6 RTMC Pro <=5.0 Mitigation: Contact Campbell Scientific for more details.

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-5434	6.9 Medium	Campbell Scientific CSI Web Server and RTMC The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stor…
CVE-2024-5433	5.3 Medium	Campbell Scientific CSI Web Server and RTMC The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted …

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.

CyberzSOC