« All blog posts

OPC UA XML External Entity (XXE) Exploit


OPC Foundation (OPCF) has announced a Security Bulletin (CVE-2018-12585) on June 20, 2018 concerning a vulnerability in the OPC UA Java Stack of OPC Foundation:

“… that allowed remote attackers to send carefully constructed requests that caused an OPC UA [server] to access unauthorized sites and potentially causing a denial of service.”

The issue is in fact a well know vulnerability in Java (and other environments), related to XML External Entities.

Prosys OPC UA products affected

The vulnerability affects directly:

  • All applications built with Prosys OPC UA Java SDK 3.1.2 and earlier
  • Prosys OPC UA Client 3.0.0 and earlier
  • Prosys OPC UA Simulation Server 3.0.0 and earlier
  • Prosys OPC UA Modbus Server 1.2.2 and earlier
  • Prosys OPC UA Historian 1.0.0

Fixed products

The issue is now fixed in Prosys OPC UA Java SDK 3.1.4, UA Client 3.1.4, Simulation Server 3.1.4 and Modbus Server 1.2.4 and we encourage everyone to update to these versions. Prosys OPC UA Historian will be updated later, respectively.

Unified Automation products affected

Although this CVE concerns the Java Stack only, a similar CVE (CVE-2017-12069) was already published previously for .NET products.

Unified Automation has released a restricted security bulletin regarding the issue. Please, find more information how to access this from the Unified Automation website.

Fixing the issue with older library versions

The issue is related to a common XXE vulnerability in Java XML components. It has now been fixed in the Java Stack and the respective fix can also be applied to application code directly, if it still needs to be built with an earlier version of the Java Stack and Java SDK. Since the fix is concerning the objects of the XmlFactoryCache and the respective objects are also available via getter methods, you can apply the same fix on these objects (‘getDocumentFactoryBuilder().setAttribute()’, etc.)

Note that the vulnerability cannot be fixed in application binaries only.

Note that the fix requires also a recent Java Virtual Machine, namely Java 7 update 67, Java 8 update 20, or above. Also, it depends on the actual XML parsers used by the JVM. The fix assumes Apache Xerces, which is the default in Oracle JDK and OpenJDK. If you have a custom environment, you will need to check the proper ways to overcome the issue.

More security information

You will find the currently announced security issues in Prosys OPC products from the blog under the #Security tag.

You might also like to read about the OPC UA Security Process of the OPC Foundation.

Jouni Aro

Jouni Aro

Chief Technology Officer

Email: jouni.aro@prosysopc.com

Expertise and responsibility areas: OPC & OPC UA product development, project work and customer support

Tags: OPC UA, Security

comments powered by Disqus

About Prosys OPC Ltd

Prosys OPC is a leading provider of professional OPC software and services with over 20 years of experience in the field. OPC and OPC UA (Unified Architecture) are communications standards used especially by industrial and high-tech companies.

Read more about us »

Newest blog posts

Why is EDGE an Important Part of Industry 4.0 Factory?

Nowadays, the EDGE offers a wider functionality than just of an aggregating OPC UA server. In reality, it is the main part of an Industry 4.0 factory.

Introducing Prosys OPC UA Edge

The very first blog post about Prosys OPC UA Edge. The article introduces the main features and functionalities of the EDGE software.

Windows DCOM Hardening And OPC Classic Applications

How do the Windows DCOM hardening changes affect your OPC Classic applications.

View all blog posts »