CVE-2023-51605
📋 TL;DR
This XXE vulnerability in Honeywell Saia PG5 Controls Suite allows attackers to read sensitive files from the system when users open malicious XML files. The vulnerability affects installations where users process untrusted XML documents. User interaction is required as victims must open a malicious file or visit a malicious webpage.
💻 Affected Systems
- Honeywell Saia PG5 Controls Suite
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system file disclosure including configuration files, credentials, and sensitive operational data from the control system environment.
Likely Case
Disclosure of local files accessible to the application process, potentially including configuration files and system information.
If Mitigated
Limited impact with proper network segmentation and user training to avoid opening untrusted files.
🎯 Exploit Status
Exploitation requires user interaction but is technically simple once a malicious file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Honeywell security advisory for specific version
Vendor Advisory: https://www.honeywell.com/us/en/support/security/cyber-security-updates
Restart Required: Yes
Instructions:
1. Check Honeywell security advisory for specific patch version
2. Download and install the security update from Honeywell
3. Restart the application and verify functionality
🔧 Temporary Workarounds
Disable XML external entity processing
allConfigure XML parser to disable external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true
Restrict file access
windowsLimit application permissions to prevent file system access
Run application with least privilege user account
Set file system permissions to restrict access
🧯 If You Can't Patch
- Implement strict user training to never open untrusted XML files
- Deploy application whitelisting to prevent execution of unauthorized applications
🔍 How to Verify
Check if Vulnerable:
Check application version against Honeywell's patched version list in security advisoryCheck Version:
Check Help > About in Saia PG5 Controls Suite applicationVerify Fix Applied:
Verify installed version matches or exceeds patched version from Honeywell advisory📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns by the application
- Multiple failed file access attempts
- Application crashes during XML processing
Network Indicators:
- Outbound connections to unusual URIs during XML processing
- Data exfiltration patterns
SIEM Query:
source="application_logs" AND (process="SaiaPG5" OR process="pg5") AND (event="file_access" OR event="xml_parse") AND result="success" AND file_path CONTAINS "file://"