CVE-2022-21939
📋 TL;DR
This vulnerability in Johnson Controls System Configuration Tool (SCT) exposes sensitive cookies to client-side scripts because they lack the 'HttpOnly' flag. Attackers could potentially steal session cookies via cross-site scripting (XSS) attacks, leading to unauthorized access. Affected users are those running SCT versions 14 prior to 14.2.3 and version 15 prior to 15.0.3.
💻 Affected Systems
- Johnson Controls System Configuration Tool (SCT)
📦 What is this software?
Metasys System Configuration Tool by Johnsoncontrols
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies via XSS, gaining full administrative access to the SCT system, potentially compromising building control systems.
Likely Case
Session hijacking leading to unauthorized access to the SCT configuration interface.
If Mitigated
Limited impact with proper network segmentation and access controls, though cookie theft remains possible.
🎯 Exploit Status
Exploitation requires XSS or similar client-side attack vectors to access cookies.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 14.2.3 or later, Version 15.0.3 or later
Vendor Advisory: https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Restart Required: Yes
Instructions:
1. Download the patched version from Johnson Controls support portal. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the SCT service.
🔧 Temporary Workarounds
Network Segmentation
allIsolate SCT systems from untrusted networks to reduce attack surface.
Web Application Firewall
allDeploy WAF with XSS protection rules to block cookie theft attempts.
🧯 If You Can't Patch
- Implement strict network access controls to limit SCT access to authorized users only.
- Monitor for suspicious authentication attempts and session anomalies.
🔍 How to Verify
Check if Vulnerable:
Check SCT version in application interface or via installed programs list.Check Version:
Check via SCT Help > About menu or Windows Programs and Features.Verify Fix Applied:
Verify version is 14.2.3+ or 15.0.3+ and test cookie headers for 'HttpOnly' flag.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts
- Unusual session creation from new IPs
Network Indicators:
- HTTP requests attempting to access cookies via JavaScript
SIEM Query:
source="sct_logs" AND (event="authentication_failure" OR event="session_hijack")