Schneider Electric EcoStruxure Building Operation WebReports / WebStation V1.9-V3.1: Authenticated file upload

Impact

Authenticated file upload with dangerous type on the WebReports component gives code execution on the EcoStruxure Building Operation server, with an XXE and a broken access-control issue alongside it that help an attacker get there and read server-side files on the way. EBO is Schneider's BAS supervisory platform and it commonly integrates the cooling plant, metering and sometimes access control for the site. Code execution on the EBO server means write authority over the Automation Servers (AS/AS-P) beneath it, which are the devices actually commanding air handling. So the physical consequence is the same as any BAS-server compromise: setpoints and fan commands under attacker control, alarms suppressible, and a hall of high-density GPU racks minutes from thermal shutdown. Worth flagging that Schneider is also the vendor for a lot of the power side in the same buildings, so a compromised EBO server frequently sits inside the same trust boundary as the electrical monitoring.

Who can reach it

Requires an authenticated EBO session for the upload path, so the realistic chain is credential theft or a weak/default operator account followed by upload. The reflected/stored XSS and access-control issues in the same cluster provide the credential-capture step. EBO WebStation is browser-based and frequently published to the corporate network for facilities staff, which is where the credentials get phished.

What to do

Software upgrade of the EcoStruxure Building Operation server and WebReports to a fixed release per Schneider's SEVD advisories - a server-side change in a normal window, no controller firmware, no cooling downtime. Also enforce MFA on the path to WebStation, remove shared facilities accounts, and take the server off the general corporate segment. In a leased colo the EBO server is the landlord's and shared across tenants: ask for the version, and note that 'authenticated' is a weak barrier when a dozen contractor accounts exist on that server.

References

Related entries

• Nagios XI: OS command injection in the windowswmi config wizard (authenticated)CVE-2021-25296 · Nagios XIHigh
• Nagios XI: OS command injection in the switch config wizardCVE-2021-25297 · Nagios XIHigh
• Nagios XI: OS command injection in the cloud-vm config wizardCVE-2021-25298 · Nagios XIHigh
• HTCondor (IDTOKENS authentication): A flaw in IDTOKENS lets a user authenticate as another user or as the condorCVE-2021-25312 · HTCondor (IDTOKENS authentication)High
• linuxptp / ptp4l (PTP message forwarding): A missing length check when ptp4l forwards a PTP message between ports leaksCVE-2021-3570 · linuxptp / ptp4l (PTP message forwarding)High
• Terraform Enterprise: Missing authorization on a subset of run-token API requestsCVE-2021-36230 · Terraform EnterpriseHigh