Full Disclosure mailing list archives

0day Rubbish Research Team is publicly disclosing a vulnerability in MAPS SCADA 4.0.5.5 (Adroit Technologies). The 
research is published and a proof-of-concept is available.

Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)

MAPS SCADA 4.0.5.5 exposes an IIS WebService (default port 8878) whose WSDataProvider.asmx endpoints deserialize the 
caller-supplied byte array before any authentication. Serializer.BinaryDeserialization internally calls new 
BinaryFormatter().Deserialize(stream) with no SerializationBinder and no TypeFilterLevel. An attacker sends a single 
unauthenticated HTTP SOAP POST carrying a GZip-compressed BinaryFormatter gadget (TypeConfuseDelegate -> 
Process.Start), achieving arbitrary command execution as the IIS app pool identity - NT AUTHORITY\SYSTEM in the default 
deployment. Dynamically verified.

Impact: Full compromise of the SCADA host as NT AUTHORITY\SYSTEM; the attacker can read any file, execute arbitrary 
commands, and take full control of the SCADA environment.

Advisory: https://0day-rubbish.com/blog/maps-scada-unauth-binaryformatter-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• Security advisory: Pre-authentication SYSTEM RCE in MAPS SCADA 4.0.5.5 (Adroit Technologies) disclosure via Fulldisclosure (Aug 17)