CVE-2021-41063
📋 TL;DR
An unauthenticated SQL injection vulnerability in Aanderaa GeoView Webservice allows attackers to execute arbitrary SQL commands on the database. This affects all systems running versions prior to 2.1.3, potentially compromising industrial control systems that use this software.
💻 Affected Systems
- Aanderaa GeoView Webservice
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing remote code execution, data exfiltration, manipulation of industrial control data, and potential physical damage to critical infrastructure.
Likely Case
Database compromise leading to data theft, manipulation of sensor readings, and disruption of monitoring systems.
If Mitigated
Limited impact with proper network segmentation and web application firewalls blocking SQL injection attempts.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited with readily available tools. Unauthenticated access lowers the barrier significantly.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.3
Vendor Advisory: https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-aanderaa-psa-2021-003.pdf
Restart Required: Yes
Instructions:
1. Download version 2.1.3 from Xylem's official distribution channels. 2. Backup current configuration and data. 3. Stop the GeoView Webservice. 4. Install the updated version. 5. Restart the service and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate GeoView Webservice from untrusted networks and implement strict firewall rules.
Web Application Firewall
allDeploy WAF with SQL injection protection rules in front of the service.
🧯 If You Can't Patch
- Implement strict network access controls allowing only trusted IP addresses
- Deploy database monitoring to detect SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Check the installed version of Aanderaa GeoView Webservice via the web interface or configuration files.Check Version:
Check web interface or consult application documentation for version displayVerify Fix Applied:
Confirm version 2.1.3 is installed and test SQL injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts or unusual parameter values in web server logs
Network Indicators:
- SQL keywords in HTTP GET/POST parameters
- Unusual database connection patterns from web service
SIEM Query:
source="web_logs" AND (url="*SELECT*" OR url="*UNION*" OR url="*INSERT*" OR url="*DELETE*" OR url="*UPDATE*")🔗 References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-334-01
- https://www.xylem.com
- https://www.xylem.com/en-us/about-xylem/cybersecurity/advisories/
- https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-aanderaa-psa-2021-003.pdf
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-334-01
- https://www.xylem.com
- https://www.xylem.com/en-us/about-xylem/cybersecurity/advisories/
- https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-aanderaa-psa-2021-003.pdf
