CVE-2024-1156
📋 TL;DR
This vulnerability involves incorrect directory permissions for the shared NI RabbitMQ service, allowing local authenticated users to read RabbitMQ configuration information. This could potentially lead to privilege escalation. It affects NI SystemLink software users with local access to vulnerable systems.
💻 Affected Systems
- NI SystemLink
📦 What is this software?
Flexlogger by Emerson
Labview Nxg by Emerson
Labview Nxg by Emerson
Labview Nxg by Emerson
Specification Compliance Manager by Emerson
⚠️ Risk & Real-World Impact
Worst Case
Local authenticated attacker reads sensitive RabbitMQ configuration, uses credentials or secrets found to escalate privileges to administrative level, potentially gaining full system control.
Likely Case
Local user accesses RabbitMQ configuration files containing service credentials, enabling unauthorized access to RabbitMQ management or other services.
If Mitigated
With proper access controls and monitoring, impact limited to configuration file access without successful privilege escalation.
🎯 Exploit Status
Exploitation requires local authenticated access and basic file system navigation skills to access improperly permissioned directories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check NI advisory for specific patched versions
Restart Required: Yes
Instructions:
1. Review NI security advisory for affected versions. 2. Download and apply the latest NI SystemLink update from NI website. 3. Restart affected services/systems as required.
🔧 Temporary Workarounds
Adjust RabbitMQ directory permissions
linuxManually correct permissions on RabbitMQ configuration directories to restrict access to authorized users only.
chmod 700 /path/to/rabbitmq/config/directory
chown rabbitmq:rabbitmq /path/to/rabbitmq/config/directory
Restrict local user access
allImplement strict access controls to limit which local users can access systems running NI SystemLink.
🧯 If You Can't Patch
- Implement strict principle of least privilege for local user accounts
- Monitor access to RabbitMQ configuration directories and alert on unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check permissions on RabbitMQ configuration directories: 'ls -la /path/to/rabbitmq/config/' and verify only RabbitMQ service user has read/write access.Check Version:
Check NI SystemLink version via NI software management tools or consult NI documentation for version checking commands.Verify Fix Applied:
Verify directory permissions are corrected and only accessible by RabbitMQ service account. Test with non-privileged user attempting to read configuration files.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to RabbitMQ configuration files
- File access logs showing non-RabbitMQ users reading configuration directories
Network Indicators:
- Unusual RabbitMQ management interface access from unexpected local users
SIEM Query:
source="file_access_logs" AND (path="*rabbitmq*config*" OR filename="rabbitmq.config") AND user!="rabbitmq"🔗 References
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html
