CVE-2023-23446
📋 TL;DR
This vulnerability allows unprivileged remote attackers to download files from SICK FTMg AIR FLOW SENSOR devices via the REST interface using low-privilege accounts. It affects specific SICK sensor models with improper access control in their REST API implementation.
💻 Affected Systems
- SICK FTMg AIR FLOW SENSOR
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could download sensitive configuration files, firmware, or operational data, potentially leading to device compromise, industrial espionage, or preparation for further attacks.
Likely Case
Unauthorized file downloads exposing device configurations, network settings, or operational parameters that could be used for reconnaissance or to facilitate other attacks.
If Mitigated
Limited impact with proper network segmentation and access controls preventing unauthorized REST API access.
🎯 Exploit Status
Requires valid low-privilege account credentials but exploitation is simple via REST API calls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific firmware versions
Vendor Advisory: https://sick.com/psirt
Restart Required: Yes
Instructions:
1. Check affected part numbers. 2. Contact SICK support for firmware updates. 3. Apply firmware update following vendor instructions. 4. Restart device.
🔧 Temporary Workarounds
Network Segmentation
allIsolate sensors in separate network segments with strict firewall rules
Access Control Restrictions
allImplement strict authentication and authorization controls for REST API access
🧯 If You Can't Patch
- Segment affected sensors in isolated network zones with no internet access
- Implement strict firewall rules blocking unauthorized REST API access from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check device part number against affected list and attempt file download via REST API with low-privilege accountCheck Version:
Check device web interface or use vendor-specific tools to query firmware versionVerify Fix Applied:
Verify firmware version is updated per vendor advisory and test that file downloads are properly restricted📡 Detection & Monitoring
Log Indicators:
- Multiple file download attempts via REST API from low-privilege accounts
- Unusual file access patterns
Network Indicators:
- HTTP GET requests to file download endpoints from unauthorized sources
- REST API traffic to sensor devices
SIEM Query:
source_ip='sensor_network' AND http_method='GET' AND uri CONTAINS '/files/' AND user_privilege='low'