CVE-2021-27471
📋 TL;DR
This vulnerability allows attackers to craft malicious files that exploit path traversal when opened in Rockwell Automation Connected Components Workbench v12.00.00 and prior. Successful exploitation could allow file system traversal, file overwriting, and creation of new files with the software's permissions. Users of affected versions who open untrusted files are at risk.
💻 Affected Systems
- Rockwell Automation Connected Components Workbench
📦 What is this software?
Connected Components Workbench by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
An attacker could overwrite critical system files, install malware, or compromise the entire system by exploiting the software's permissions.
Likely Case
Local file manipulation, data corruption, or limited malware installation through crafted files opened by users.
If Mitigated
Limited impact with proper user training, file validation, and restricted permissions on the software.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious file) and crafting specific file types.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v12.00.01 or later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435
Restart Required: Yes
Instructions:
1. Download the latest version from Rockwell Automation's website. 2. Uninstall the vulnerable version. 3. Install the patched version. 4. Restart the system.
🔧 Temporary Workarounds
Restrict file opening
allOnly open trusted files from verified sources in Connected Components Workbench.
Run with limited permissions
windowsRun the software with reduced user privileges to limit file system access.
🧯 If You Can't Patch
- Implement strict user training to avoid opening untrusted files.
- Use application whitelisting to restrict execution of unauthorized files.
🔍 How to Verify
Check if Vulnerable:
Check the software version in Help > About Connected Components Workbench.Check Version:
In Connected Components Workbench, navigate to Help > About.Verify Fix Applied:
Verify the installed version is v12.00.01 or later.📡 Detection & Monitoring
Log Indicators:
- Unexpected file creation or modification events in system logs
- Application crashes or errors when opening files
Network Indicators:
- No direct network indicators; exploit is file-based
SIEM Query:
Search for file creation/modification events in paths outside expected directories by the Connected Components Workbench process.