[FD] Security advisory: Pre-authentication SYSTEM RCE in MAPS SCADA 4.0.5.5 (Adroit Technologies)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in MAPS SCADA 
4.0.5.5 (Adroit Technologies). The research is published and a proof-of-concept 
is available.

Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)

MAPS SCADA 4.0.5.5 exposes an IIS WebService (default port 8878) whose 
WSDataProvider.asmx endpoints deserialize the caller-supplied byte array before 
any authentication. Serializer.BinaryDeserialization internally calls new 
BinaryFormatter().Deserialize(stream) with no SerializationBinder and no 
TypeFilterLevel. An attacker sends a single unauthenticated HTTP SOAP POST 
carrying a GZip-compressed BinaryFormatter gadget (TypeConfuseDelegate -> 
Process.Start), achieving arbitrary command execution as the IIS app pool 
identity - NT AUTHORITY\SYSTEM in the default deployment. Dynamically verified.

Impact: Full compromise of the SCADA host as NT AUTHORITY\SYSTEM; the attacker 
can read any file, execute arbitrary commands, and take full control of the 
SCADA environment.

Advisory: https://0day-rubbish.com/blog/maps-scada-unauth-binaryformatter-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/