CVE-2023-34353
📋 TL;DR
This authentication bypass vulnerability in Open Automation Software OAS Platform allows attackers to decrypt sensitive information by sniffing network traffic. It affects OAS Engine authentication functionality, potentially exposing credentials and other protected data. Organizations using vulnerable versions of OAS Platform are at risk.
💻 Affected Systems
- Open Automation Software OAS Platform
📦 What is this software?
Oas Platform by Openautomationsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of OAS Platform with unauthorized access to industrial control systems, data exfiltration, and potential manipulation of operational technology.
Likely Case
Credential theft leading to unauthorized access to OAS Platform, exposure of sensitive configuration data, and potential lateral movement within the network.
If Mitigated
Limited impact with encrypted traffic preventing decryption, though authentication mechanisms remain vulnerable to targeted attacks.
🎯 Exploit Status
Exploitation requires network access to sniff traffic. No authentication needed to intercept and decrypt sensitive data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v18.00.0073 or later
Vendor Advisory: https://openautomationsoftware.com/security-advisories/
Restart Required: Yes
Instructions:
1. Download latest version from Open Automation Software website. 2. Backup current configuration. 3. Install update following vendor instructions. 4. Restart OAS services. 5. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate OAS Platform traffic to prevent sniffing attacks
Encryption Enforcement
allRequire TLS/SSL for all OAS Platform communications
Configure OAS Platform to use TLS 1.2 or higher
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OAS Platform from untrusted networks
- Deploy network monitoring and intrusion detection to alert on suspicious traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check OAS Platform version in administration console or via version command. If version is v18.00.0072 or earlier, system is vulnerable.Check Version:
Check OAS Platform administration interface or run platform-specific version commandVerify Fix Applied:
Verify version is v18.00.0073 or later. Test authentication functionality and monitor for any decryption issues.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts from unexpected sources
- Unusual network traffic patterns to OAS services
Network Indicators:
- Unencrypted authentication traffic to OAS Platform
- Suspicious network sniffing activity on OAS network segments
SIEM Query:
source="OAS_Platform" AND (event_type="authentication" OR event_type="network") AND status="failed"