ICS Advisories

Risk evaluation

A low privileged attacker with physical access to a controller, that supports removable media and is running a CODESYS Control runtime system, can exploit the insufficient path validation by connecting removable media with a file system supporting symbolic links. This could allow the attacker to bypass SysFile restrictions and gain unauthorized access to the entire file system.

Mitigation summary

Regardless of the vulnerability described here, CODESYS GmbH recommends that physical access to the controller should only be granted to authorized persons. Especially in the case of productive control systems, physical manipulation of the controller can affect the controlled machine or process. This generally recommended restriction of access also reduces the attack surface for this vulnerability, as its exploitation requires physical access. To exploit this vulnerability, a successful login to the affected product is required. The online user management therefore protects from exploiting this security vulnerability. CODESYS GmbH strongly recommends using the online user management, which is enforced by default. This not only prevents from accessing the file system with malicious symbolic links, but also suppresses modifying the PLC application, or starting, stopping, debugging or other actions on a known working PLC application that could potentially disrupt a machine or system. To fully mitigate this vulnerability, system administrators can restrict the use of removable media to devices that do not support symbolic links, such as FAT16 or FAT32. Since these file systems lack symbolic link functionality, this effectively prevents any symbolic link-based attacks. Alternatively, remove PlaceHolderFilePath settings from the CODESYS Control configuration file, which point to removable media such as: [SysFile] PlaceholderFilePath.1=/media/usb, $USB$