CVE-2023-2913
📋 TL;DR
A path traversal vulnerability in Rockwell Automation ThinManager ThinServer allows remote attackers to read arbitrary files on the server's file system when the API feature is enabled. This affects systems where the optional API is manually enabled in HTTPS Server Settings. The vulnerability leverages server privileges to access sensitive files.
💻 Affected Systems
- Rockwell Automation ThinManager ThinServer
📦 What is this software?
Thinmanager by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of server file system, exposure of sensitive configuration files, credentials, and proprietary data leading to operational disruption and data theft.
Likely Case
Unauthorized reading of configuration files, logs, and potentially sensitive operational data stored on the server.
If Mitigated
Limited impact due to API being disabled by default and proper network segmentation preventing external access.
🎯 Exploit Status
Exploitation requires API to be enabled and involves manipulating path variables in requests
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in advisory, refer to vendor update
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140160
Restart Required: Yes
Instructions:
1. Apply latest ThinManager ThinServer update from Rockwell Automation. 2. Restart the service. 3. Verify API functionality if required.
🔧 Temporary Workarounds
Disable API Feature
windowsDisable the vulnerable API feature in HTTPS Server Settings
Navigate to ThinServer configuration > HTTPS Server Settings > Disable API feature
Network Segmentation
allRestrict network access to ThinServer to trusted networks only
Configure firewall rules to limit inbound connections to ThinServer ports
🧯 If You Can't Patch
- Ensure API feature remains disabled in HTTPS Server Settings
- Implement strict network access controls and segment ThinServer from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check ThinServer configuration to see if API feature is enabled in HTTPS Server SettingsCheck Version:
Check ThinServer About or version information in application interfaceVerify Fix Applied:
Verify API feature is disabled or latest patched version is installed and test path traversal attempts📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in ThinServer logs
- HTTP requests with manipulated path parameters to API endpoints
Network Indicators:
- HTTP requests containing path traversal sequences (../) to ThinServer API
SIEM Query:
source="thinserver" AND (uri="*../*" OR method="GET" AND uri="*/api/*")