CVE-2020-9049
📋 TL;DR
This vulnerability allows unauthenticated attackers to forge JSON Web Tokens and execute unauthorized API methods on American Dynamics victor Web Client and Software House C•CURE Web Client systems. It affects organizations using these physical security access control systems, potentially allowing attackers to bypass authentication and conduct denial-of-service attacks.
💻 Affected Systems
- American Dynamics victor Web Client
- Software House C•CURE Web Client
📦 What is this software?
C Cure Web by Johnsoncontrols
Victor Web by Johnsoncontrols
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to manipulate access control systems, disable security functions, or conduct sustained denial-of-service attacks that render physical security systems inoperable.
Likely Case
Unauthorized API access leading to system disruption, data exposure, or manipulation of access control settings without proper authentication.
If Mitigated
Limited impact with proper network segmentation and monitoring, though authentication bypass remains possible if systems are exposed.
🎯 Exploit Status
Exploitation involves JWT manipulation which is well-documented and tools exist for JWT attacks. No public exploit code identified but technique is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Johnson Controls security advisory for specific patched versions
Vendor Advisory: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Restart Required: Yes
Instructions:
1. Review Johnson Controls security advisory ICSA-20-324-01 2. Identify affected versions 3. Apply vendor-provided patches 4. Restart affected services 5. Verify patch application
🔧 Temporary Workarounds
Network Segmentation
allIsolate vulnerable web clients from untrusted networks and restrict access to authorized IP addresses only
Configure firewall rules to restrict access to web client ports (typically 80/443)
Access Control Lists
allImplement strict network access controls to limit who can reach the vulnerable web interfaces
Use network ACLs to allow only authorized management stations
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to isolate vulnerable systems
- Monitor for unusual JWT activity and unauthorized API calls to the web client interfaces
🔍 How to Verify
Check if Vulnerable:
Check system version against Johnson Controls advisory and verify if JWT authentication can be bypassedCheck Version:
Check web client interface or system documentation for version informationVerify Fix Applied:
Verify patch version is installed and test that JWT authentication properly validates tokens📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful API calls
- Unusual JWT generation patterns
- API calls from unexpected sources
Network Indicators:
- HTTP requests with manipulated JWT tokens to web client APIs
- Unauthorized API method executions
SIEM Query:
source="web_client" AND (event="authentication_failure" OR event="api_call") | stats count by src_ip, user, event🔗 References
- https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01
- https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories
- https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01
- https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories
