ICS Advisories

Risk evaluation

On certain operating systems (e.g., Linux), default file system permissions may allow read access to the files of the CODESYS Control runtime system for non-administrator users. The documentation provided with the CODESYS Runtime Toolkit does not explicitly address this risk. As a result, products based on the toolkit may unintentionally expose sensitive runtime files to local operating system users with limited privileges. CODESYS Control runtime system based devices are affected if they provide access to the operating system (e.g., via a local user interface or SSH) and user accounts without administrator rights for this access exist or can be created.

Mitigation summary

If the CODESYS Control runtime system is operated on an operating system with multi-user support, other users may potentially gain access to runtime-related files. Thus, it is essential to configure the storage locations for CODESYS Control runtime files in accordance with the operating system's security best practices. These locations should, by default, restrict access to unauthorized users. If the operating system does not support such access control mechanisms or if implementing them is not feasible, an alternative approach is to explicitly revoke read and write permissions for all non-administrative users on the directories used by the CODESYS Control runtime system. The following directories must be secured: * The directory containing configuration files * The directory containing binary files * The working directory used by the runtime system Note: Protecting individual files is not sufficient. The entire directories must be secured to ensure that any files created in the future are also protected. Alternatively, where applicable, all non-administrative user accounts can be removed from the system, and their re-creation should be prevented. Additionally, it is recommended to disable remote access methods that allow file access (e.g., SSH) wherever possible, in order to reduce the overall attack surface. Best practice recommendations for Linux and QNX Systems: * Create a dedicated privileged group for accessing the above-mentioned directories, and add the user account under which the runtime process is executed to this group. * Set the file system permissions for these directories to deny access to "other" users (e.g., chmod o-rx). * If access for additional users is required, they can be added to the privileged group as needed.