Security advisory: multiple vulnerabilities including JWT forgery / authentication bypass, Pre-authentication SYSTEM RCE in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.)
disclosure via Fulldisclosure ·
0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.). The research is published and a proof-of-concept is available. Vulnerability 1: Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication) The native engine PwrStudio.exe runs as the Windows service CircutorPowerStudioScadaServer under NT AUTHORITY\SYSTEM. The shared fail-open JWT library (see companion advisory) accepts a forged alg=none JWT with role=Admin. Combined with a path-traversal write of a malicious default.xeve events configuration (containing a shellExecute action) against PSSWidgets (port 8105) and an HTTP engine restart against PSSAdministrator (port 8089), an unauthenticated attacker forces the engine to reload the configuration and fire XCEventActionShellExecute::Execute, which reaches CreateProcessW with attacker-controlled arguments as SYSTEM. Under a strict default deployment where 8089 is loopback-only with no forwarding path, the chain does not close for a pure-remote unauthenticated attacker; once 8089 is reachable (reverse proxy, rebind, same-host, or same segment), it is a full unauthenticated remote SYSTEM RCE. Impact: Arbitrary command execution as NT AUTHORITY\SYSTEM on the SCADA host; the attacker controls the SCADA engine, the event configuration, and the underlying Windows host. Advisory: https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce Vulnerability 2: JWT forgery / authentication bypass (CVSS 8.6, pre-authentication) Every .NET Core microservice registers JWT Bearer authentication via a shared extension method configured fail-open: a custom SignatureValidator that always returns a non-null token without validating the signature, RequireSignedTokens=false, ValidateIssuerSigningKey=false, ValidateIssuer=false, ValidateAudience=false, and an OnAuthenticationFailed handler that silently swallows exceptions. Any attacker-crafted alg=none JWT with any role claim is accepted as a valid authenticated identity by every microservice's AdminSecure/UserSecure policy. No credentials, no signing key, and no user account are required; only network reachability to the target microservice port. This is an authentication-bypass/identity-forgery primitive that compromises the product's entire authentication trust root and is the auth-bypass primitive that enables the companion shellExecute RCE chain. Impact: Impersonate any Admin/User role and call any protected endpoint: stop/start the SCADA engine or microservices (DoS), push configuration, upload/download/delete files, configure external communication, and manage licenses; no credentials required. Advisory: https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/