CVE-2021-34605

A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure and denial of service of the system running the XINJE XD/E Series PLC Program Tool.

CVSS v3 7.3 HIGH
CVSS v2.0 6.0 MEDIUM

7.3^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:xinje:xd\/e_series_plc_program_tool:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-05-11 15:15

Updated : 2022-05-19 17:06

NVD link : CVE-2021-34605

Mitre link : CVE-2021-34605

CVE.ORG link : CVE-2021-34605

JSON object : View

Products Affected

xinje

xd\/e_series_plc_program_tool

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2021-34605", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}, {"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "published": "2022-05-11T15:15:08.343", "references": [{"url": "https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool/", "tags": ["Exploit", "Third Party Advisory"], "source": "info@cert.vde.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure and denial of service of the system running the XINJE XD/E Series PLC Program Tool."}, {"lang": "es", "value": "Una vulnerabilidad de deslizamiento de zip en XINJE XD/E Series PLC Program Tool versiones hasta v3.5.1, puede proporcionar a un atacante privilegios de escritura de archivos arbitrarios cuando abre un archivo de proyecto especialmente dise\u00f1ado. Esta vulnerabilidad puede ser desencadenada al abrir manualmente un archivo de proyecto infectado, o al iniciar una petici\u00f3n de carga de programa desde un PLC Xinje infectado. Esto puede resultar en una ejecuci\u00f3n de c\u00f3digo remota, una divulgaci\u00f3n de informaci\u00f3n y una denegaci\u00f3n de servicio del sistema que ejecuta XINJE XD/E Series PLC Program Tool"}], "lastModified": "2022-05-19T17:06:47.307", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xinje:xd\\/e_series_plc_program_tool:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E09E56A-B91C-43D7-8996-42B4EE6151F6", "versionEndIncluding": "3.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "info@cert.vde.com"}

7.3 /10