CVE-2020-24673
📋 TL;DR
This critical SQL injection vulnerability in ABB's S+ Operations and S+ Historian software allows attackers to execute arbitrary SQL commands on the database. Successful exploitation can lead to data theft, data manipulation, database administration operations, file system access, and potentially operating system command execution. Organizations using affected versions of these industrial control system products are at risk.
💻 Affected Systems
- S+ Operations
- S+ Historian
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the database and underlying operating system, allowing data exfiltration, system manipulation, and potential disruption of industrial operations.
Likely Case
Unauthorized data access and manipulation, potentially leading to operational data corruption or theft of sensitive industrial information.
If Mitigated
Limited impact with proper network segmentation, database permissions, and input validation controls in place.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit with automated tools
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches available via ABB security advisories
Vendor Advisory: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
Restart Required: Yes
Instructions:
1. Download patches from ABB security advisories 2. Apply patches following ABB documentation 3. Restart affected services 4. Verify patch application
🔧 Temporary Workarounds
Network Segmentation
allIsolate S+ systems from untrusted networks and implement strict firewall rules
Database Permission Reduction
allLimit database user permissions to minimum required functionality
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in custom applications
- Deploy web application firewall (WAF) with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running unpatched versions of S+ Operations or S+ HistorianCheck Version:
Check version through S+ software interface or installation directoryVerify Fix Applied:
Verify patch installation and check version against ABB's patched versions📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns
- Database error logs showing SQL syntax errors
- Unexpected database administration commands
Network Indicators:
- SQL injection patterns in network traffic to S+ services
- Unusual database connection attempts
SIEM Query:
source="S+_logs" AND ("sql" OR "database") AND ("error" OR "unexpected" OR "syntax")🔗 References
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
