CVE-2021-34599
📋 TL;DR
CVE-2021-34599 is a certificate validation vulnerability in CODESYS Git versions prior to V1.1.0.0 that allows man-in-the-middle attacks by not verifying HTTPS server certificates. This affects users of CODESYS Git who connect to remote Git repositories over HTTPS.
💻 Affected Systems
- CODESYS Git
📦 What is this software?
Git by Codesys
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept, modify, or inject malicious code into Git operations, potentially compromising industrial control systems or stealing intellectual property.
Likely Case
Unauthorized access to source code repositories, injection of malicious code into automation projects, or data exfiltration during Git operations.
If Mitigated
Limited impact with proper network segmentation and certificate validation enabled.
🎯 Exploit Status
Man-in-the-middle attacks are well-understood and tools for HTTPS interception are widely available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.1.0.0
Vendor Advisory: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16959&token=3ce11e44a3277c4520d732ea2e630f2e06bd46ff&download
Restart Required: Yes
Instructions:
1. Download CODESYS Git V1.1.0.0 or later from CODESYS website. 2. Install the update following vendor instructions. 3. Restart affected systems.
🔧 Temporary Workarounds
Use SSH instead of HTTPS
allConfigure Git to use SSH protocol instead of HTTPS for repository connections
git remote set-url origin git@github.com:user/repo.git
Enable certificate validation
allConfigure CODESYS Git to enforce certificate validation if supported in current version
🧯 If You Can't Patch
- Isolate CODESYS Git systems from untrusted networks using firewalls
- Use VPNs for all remote Git connections to ensure encrypted tunnels
🔍 How to Verify
Check if Vulnerable:
Check CODESYS Git version in application settings or about dialogCheck Version:
Check via CODESYS Git interface or installation detailsVerify Fix Applied:
Verify version is V1.1.0.0 or later and test HTTPS connections to known valid servers📡 Detection & Monitoring
Log Indicators:
- Failed HTTPS connections to Git servers
- Unexpected certificate warnings
Network Indicators:
- Unencrypted Git traffic
- HTTPS connections to unusual IP addresses
SIEM Query:
HTTPS traffic from CODESYS Git systems with certificate validation errors