In the ever-evolving world of cybersecurity, vulnerabilities have a knack for popping up where you least expect them. Subnet Solutions Inc.’s PowerSYSTEM Center is the latest target of three notable vulnerabilities that have sent organizations scrambling for patches: Server-Side Request Forgery (SSRF), Cross-Site Request Forgery (CSRF), and Inefficient Regular Expression Complexity (ReDoS). According to a recent advisory from CISA, these vulnerabilities pose a significant risk, particularly for industrial control systems (ICS). Let’s explore these vulnerabilities, the risks they present, and—most importantly—how to mitigate them effectively before they wreak havoc on your system.
Vulnerability Breakdown: The Power Trio of Trouble
1. Server-Side Request Forgery (SSRF) – CWE-918
SSRF is the slick con artist of the cybersecurity world. In an SSRF attack, an attacker tricks a vulnerable server into making requests on its behalf, often targeting internal services that are otherwise inaccessible. The PowerSYSTEM Center was found to be susceptible to SSRF due to a flaw in the Axios NPM package version 0.21.0, which allows an attacker to bypass security controls by sending requests to restricted internal resources.
In practical terms, SSRF can be exploited to gain access to sensitive internal services, bypass firewalls, and even conduct port scanning of internal networks. CVE-2020-28168 (link: CVE-2020-28168) is the specific identifier for this vulnerability, carrying a CVSS v3 score of 5.9. This relatively high severity score indicates that while the vulnerability requires some skill to exploit, its consequences can be significant—such as gaining unauthorized access to sensitive data or services.
If you’ve ever wondered how a seemingly harmless URL request could be used against your server, this is how. In SSRF, the server acts as a proxy for the attacker, allowing them to bypass your carefully configured security rules. It’s like leaving your house locked but handing the burglar the keys through a side window.
2. Cross-Site Request Forgery (CSRF) – CWE-352
CSRF is the underhanded manipulator of the web security world. It tricks legitimate users into performing actions they never intended, such as changing account settings or transferring funds. The PowerSYSTEM Center is vulnerable to this type of attack due to a flaw in the Axios package (version 1.5.1), which unintentionally leaks the XSRF-TOKEN stored in cookies by including it in the HTTP header for every request.
This token leakage is classified under CVE-2023-45857 (link: CVE-2023-45857), and it has a CVSS v3 score of 6.5. An attacker could use this vulnerability to impersonate a legitimate user and execute actions on their behalf. In a worst-case scenario, this could result in unauthorized changes to sensitive configurations or the disclosure of confidential information.
What makes CSRF particularly sneaky is that it exploits the trust a site places in a user’s browser. When your browser sends along a request with your credentials, it’s game over if an attacker has crafted that request.
3. Inefficient Regular Expression Complexity (ReDoS) – CWE-1333
Finally, we have ReDoS, a classic example of how something as mundane as regular expressions can turn on you. Regular expressions (regex) are incredibly useful tools for searching and pattern matching, but poorly designed ones can lead to catastrophic backtracking—causing your system’s CPU to work overtime trying to match complex patterns.
PowerSYSTEM Center was vulnerable to this issue through the use of Axios, which inadvertently introduced inefficient regex patterns. An attacker could exploit this flaw, causing your system to grind to a halt under the weight of excessive CPU consumption. This vulnerability is listed as CVE-2021-3749 (link: CVE-2021-3749) and has a CVSS v3 score of 7.5, marking it as a particularly dangerous flaw that could lead to a denial-of-service (DoS) attack.
While it might seem odd that regular expressions could be weaponized, ReDoS makes it happen. Think of it as giving your system an unsolvable puzzle that ties it in knots, leaving it gasping for processing power.
Why These Vulnerabilities Matter for ICS
For the uninitiated, the industrial control systems (ICS) landscape involves some of the most critical infrastructure components—power grids, manufacturing plants, and other essential services. When SSRF, CSRF, or ReDoS strike in an ICS environment, the consequences are far more serious than losing a few customer records. You’re talking about the potential disruption of energy supplies, malfunctioning equipment, or even shutdowns of entire industrial processes.
In fact, CISA has flagged PowerSYSTEM Center’s vulnerabilities because they could lead to serious disruptions, including denial-of-service conditions, unauthorized access to sensitive information, or unintentional proxying to dangerous internal systems. The stakes are high, and organizations that fail to patch these vulnerabilities are putting critical infrastructure at risk.
Mitigating the Risks: Time to Lock Down
The good news? These vulnerabilities aren’t sitting in your system without recourse. Subnet Solutions Inc. has provided mitigation steps to safeguard PowerSYSTEM Center, and here’s how you can take action:
1. Update Your System
This should go without saying, but it often bears repeating—update your systems. Subnet Solutions recommends updating to PowerSYSTEM Center 2020 Update 22, which patches these vulnerabilities. You can check your version by heading to Settings > Overview > Version. For further assistance, contact Subnet’s customer service.
2. Limit Outbound Requests
To mitigate the effects of SSRF and CSRF, you should limit outbound connection requests from PowerSYSTEM Center’s security zone to external websites. This ensures that even if an attacker attempts to exploit the vulnerability, their reach will be significantly limited.
3. Disable Developer Tools
Subnet Solutions also advises disabling access to the F12 Developer Tools in browsers for PowerSYSTEM Center Client Access Server users. This helps prevent attackers from viewing HTTP headers and tampering with the XSRF-TOKEN.
4. Network Isolation
Keep your ICS networks behind firewalls and ensure they’re not accessible from the internet. When remote access is needed, use VPNs and ensure they’re updated to the latest versions. For more on best practices in industrial control system security, check out CISA’s guidance on defense-in-depth strategies.
5. Stay Informed
Knowledge is power. Regularly check for updates from CISA and other authoritative bodies. Keeping abreast of advisories, such as the PowerSYSTEM Center CISA advisory, ensures you are aware of vulnerabilities before they can be exploited.
FAQs
What is SSRF and why should I care?
Server-Side Request Forgery (SSRF) allows an attacker to send requests from your server to unintended internal services, bypassing firewalls and security controls. This can result in unauthorized access to sensitive internal data. Learn more about SSRF here.
How does ReDoS affect my system?
Regular Expression Denial of Service (ReDoS) exploits inefficient regex patterns to overload your system’s CPU, potentially leading to a denial-of-service (DoS) attack. Check out the full details on ReDoS here.
What makes CSRF so dangerous in industrial control systems?
Cross-Site Request Forgery (CSRF) tricks a user into unknowingly executing actions on a system where they are authenticated. In an ICS environment, this could lead to unauthorized configuration changes, system shutdowns, or data leaks. Explore more about CSRF here.
How can I secure my PowerSYSTEM Center?
Update to the latest version, limit outbound requests, disable developer tools, and isolate your ICS networks. Keeping your systems up to date is the most effective way to mitigate these vulnerabilities.
Conclusion: A Call to Action
These vulnerabilities are serious, but they don’t have to spell disaster for your systems. By staying vigilant, applying patches, and following cybersecurity best practices, you can mitigate the risks posed by SSRF, CSRF, and ReDoS. Subnet Solutions has made the necessary patches available, and it’s now up to you to implement them. Don’t wait until it’s too late—take action now to protect your systems and keep your infrastructure secure.
Ready to make your systems bulletproof? Subscribe to our newsletter for the latest cybersecurity insights and updates.
