{"containers": {"cna": {"affected": [{"product": "ToolBoxST", "vendor": "GE Gas Power", "versions": [{"lessThan": "07.09.07C", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Sharon Briznov of Claroty reported these vulnerabilities to GE."}], "datePublic": "2022-01-25T00:00:00", "descriptions": [{"lang": "en", "value": "GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference ('XXE')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-03-25T18:02:29", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01"}], "solutions": [{"lang": "en", "value": "GE addressed CVE-2021-44477 in ToolBoxST OS Version 07.09.07C and above by disabling the use of DTD\u2019s, which are not necessary for ToolBoxST functionality.\n\nGE upgraded the Ionic library in ToolBoxST Version 7.8.0 to resolve CVE-2018-16202\n\nUsers should ensure they follow the password protection and network segmentation guidance laid out in GEH-6839 Secure Deployment Guide. Additionally, the use of SDI Secure Mode offers considerable protection against this attack as the threat actor must be able to perform a download to the controller over SDI. Secure Mode validates authenticity and protects against spoofing of SDI commands.\n"}], "source": {"discovery": "EXTERNAL"}, "title": "GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference", "workarounds": [{"lang": "en", "value": "GE Gas Power Cybersecurity and Engineering teams will continue to investigate internally as well as monitor industry-based news for any changes or updates. To reduce the risk vulnerabilities such as these may represent to the controls network, GE recommends the implementation of a good defense-in-depth strategy as detailed in GEH-6839. Some recommended controls include:\n Minimize network exposure for all controllers with the use of network segmentation, placement of controllers behind controls network firewalls and ensure they are not accessible from the Internet.\n Block suspicious external IP addresses at the controls network firewalls. Monitor traffic internally for unusual behavior.\n When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.\n Implement defense-in-depth within the controls network environment consisting of tools such as Intrusion detection/prevention systems (IDS/IPS), firewalls, and network access control (NAC).\n Implement and maintain an anti-malware solution and an endpoint detection and response (EDR) solution.\n Disable remote access services and protocols such as remote desktop protocol (RDP) unless needed. Monitor and restrict remote access usage on a least-privilege basis.\n Have backup and restore processes and procedures in place for disaster recovery and incident response.\n Monitor and maintain account provisioning and access control based on the principle of least privilege.\n"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2022-01-25T22:51:00.000Z", "ID": "CVE-2021-44477", "STATE": "PUBLIC", "TITLE": "GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ToolBoxST", "version": {"version_data": [{"version_affected": "<", "version_value": "07.09.07C"}]}}]}, "vendor_name": "GE Gas Power"}]}}, "credit": [{"lang": "eng", "value": "Sharon Briznov of Claroty reported these vulnerabilities to GE."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-611 Improper Restriction of XML External Entity Reference ('XXE')"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01", "refsource": "CONFIRM", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01"}]}, "solution": [{"lang": "en", "value": "GE addressed CVE-2021-44477 in ToolBoxST OS Version 07.09.07C and above by disabling the use of DTD\u2019s, which are not necessary for ToolBoxST functionality.\n\nGE upgraded the Ionic library in ToolBoxST Version 7.8.0 to resolve CVE-2018-16202\n\nUsers should ensure they follow the password protection and network segmentation guidance laid out in GEH-6839 Secure Deployment Guide. Additionally, the use of SDI Secure Mode offers considerable protection against this attack as the threat actor must be able to perform a download to the controller over SDI. Secure Mode validates authenticity and protects against spoofing of SDI commands.\n"}], "source": {"discovery": "EXTERNAL"}, "work_around": [{"lang": "en", "value": "GE Gas Power Cybersecurity and Engineering teams will continue to investigate internally as well as monitor industry-based news for any changes or updates. To reduce the risk vulnerabilities such as these may represent to the controls network, GE recommends the implementation of a good defense-in-depth strategy as detailed in GEH-6839. Some recommended controls include:\n Minimize network exposure for all controllers with the use of network segmentation, placement of controllers behind controls network firewalls and ensure they are not accessible from the Internet.\n Block suspicious external IP addresses at the controls network firewalls. Monitor traffic internally for unusual behavior.\n When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.\n Implement defense-in-depth within the controls network environment consisting of tools such as Intrusion detection/prevention systems (IDS/IPS), firewalls, and network access control (NAC).\n Implement and maintain an anti-malware solution and an endpoint detection and response (EDR) solution.\n Disable remote access services and protocols such as remote desktop protocol (RDP) unless needed. Monitor and restrict remote access usage on a least-privilege basis.\n Have backup and restore processes and procedures in place for disaster recovery and incident response.\n Monitor and maintain account provisioning and access control based on the principle of least privilege.\n"}]}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2021-44477", "datePublished": "2022-01-25T00:00:00", "dateReserved": "2021-12-03T00:00:00", "dateUpdated": "2022-03-25T18:02:29", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ge:toolboxst:*:*:*:*:*:*:*:*", "matchCriteriaId": "E124D2FA-3D75-4461-8E7B-2DB6FB2B0262", "versionEndExcluding": "07.09.07c", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file."}, {"lang": "es", "value": "GE Gas Power ToolBoxST Versi\u00f3n v04.07.05C, sufre una vulnerabilidad de tipo XML external entity (XXE) usando la t\u00e9cnica de entidades de par\u00e1metros DTD que podr\u00eda resultar en una divulgaci\u00f3n y recuperaci\u00f3n de datos arbitrarios en el nodo afectado por medio de un ataque fuera de banda (OOB). La vulnerabilidad es desencadenada cuando la entrada que es pasada al analizador XML no es saneada mientras es analizado el archivo de proyecto/plantilla XML"}], "id": "CVE-2021-44477", "lastModified": "2022-04-04T14:30:52.257", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-03-25T19:15:09.433", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-611"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}