CVE-2021-26828
📋 TL;DR
This vulnerability allows remote authenticated users to upload and execute arbitrary JSP files via the view_edit.shtm endpoint in ScadaBR. This leads to remote code execution on affected systems. Users of ScadaBR versions through 0.9.1 on Linux and through 1.12.4 on Windows are affected.
💻 Affected Systems
- ScadaBR
📦 What is this software?
Scadabr by Scadabr
Scadabr by Scadabr
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, steal sensitive industrial control data, manipulate SCADA operations, and pivot to other network systems.
Likely Case
Attackers gain shell access to the SCADA server, potentially disrupting industrial processes, exfiltrating sensitive data, or installing persistent backdoors.
If Mitigated
Limited impact with proper network segmentation, strong authentication controls, and file upload restrictions in place.
🎯 Exploit Status
Public exploit code and demonstration videos are available. Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4
Restart Required: No
Instructions:
No official patch available. Consider upgrading to newer versions if available, or implement workarounds and security controls.
🔧 Temporary Workarounds
Restrict file upload functionality
allDisable or restrict the view_edit.shtm endpoint and file upload capabilities in ScadaBR configuration.
# Modify ScadaBR configuration to disable vulnerable endpoints
# Consult ScadaBR documentation for specific configuration changes
Implement web application firewall rules
linuxBlock requests to view_edit.shtm and filter JSP file uploads at the network perimeter.
# Example WAF rule to block view_edit.shtm requests
# Example: iptables -A INPUT -p tcp --dport 80 -m string --string "view_edit.shtm" --algo bm -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SCADA systems from other networks.
- Enforce strong authentication policies and monitor for suspicious login attempts.
🔍 How to Verify
Check if Vulnerable:
Check ScadaBR version: Linux versions ≤0.9.1 or Windows versions ≤1.12.4 are vulnerable. Test authenticated access to view_edit.shtm endpoint.Check Version:
# Check ScadaBR version via web interface or configuration filesVerify Fix Applied:
Verify that view_edit.shtm endpoint is no longer accessible or file upload functionality is properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to view_edit.shtm
- JSP file creation in unexpected directories
- Authentication logs showing brute force attempts
Network Indicators:
- HTTP POST requests to view_edit.shtm with file uploads
- Unexpected outbound connections from SCADA systems
SIEM Query:
source="web_logs" AND uri="/view_edit.shtm" AND method="POST" AND status=200🔗 References
- http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4
- http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html
- https://youtu.be/k1teIStQr1A
- http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4
- http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html
- https://youtu.be/k1teIStQr1A
- https://github.com/SCADA-LTS/Scada-LTS/pull/2174
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26828
