CVE-2023-43698
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in SICK APU's RDT400 component that allows an unprivileged remote attacker to inject malicious scripts into web pages. When exploited, arbitrary code executes in victims' browsers, potentially compromising their sessions or devices. Organizations using affected SICK APU systems with RDT400 are vulnerable.
💻 Affected Systems
- SICK APU with RDT400 component
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of client browsers, session hijacking, credential theft, malware deployment, and lateral movement within networks.
Likely Case
Session hijacking, credential theft, defacement of web interfaces, and limited client-side data exfiltration.
If Mitigated
Minimal impact with proper input validation, output encoding, and Content Security Policy (CSP) headers in place.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity; attacker needs to inject malicious scripts via web inputs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://sick.com/psirt
Restart Required: Yes
Instructions:
1. Access SICK APU management interface. 2. Check for firmware updates via vendor portal. 3. Apply latest firmware patch from SICK. 4. Restart the APU device to apply changes.
🔧 Temporary Workarounds
Implement Content Security Policy (CSP)
allAdd CSP headers to restrict script execution sources and mitigate XSS impact.
Add 'Content-Security-Policy' header in web server configuration with appropriate directives.
Input Validation and Output Encoding
allSanitize all user inputs and encode outputs in web applications to prevent script injection.
Implement server-side validation and use encoding libraries (e.g., OWASP Java Encoder for Java apps).
🧯 If You Can't Patch
- Isolate affected systems in segmented network zones to limit attack surface.
- Deploy web application firewalls (WAF) with XSS protection rules to block malicious inputs.
🔍 How to Verify
Check if Vulnerable:
Test web inputs in RDT400 interface for script injection; if unsanitized scripts execute, system is vulnerable.Check Version:
Check firmware version via SICK APU web interface or CLI; command varies by model (e.g., 'show version' in CLI).Verify Fix Applied:
After patching, retest XSS vectors; scripts should be neutralized or blocked. Check firmware version against patched release.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests with script tags or encoded payloads in query parameters or POST data.
- Errors from input validation failures in web server logs.
Network Indicators:
- HTTP traffic containing malicious script patterns (e.g., <script>, javascript:) to RDT400 endpoints.
SIEM Query:
source="web_logs" AND (uri="*<script>*" OR uri="*javascript:*")