CVE-2019-11370 in pCOWeb
Summary
by MITRE
Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2024
The vulnerability CVE-2019-11370 represents a stored cross-site scripting flaw in Carel pCOWeb software versions prior to B1.2.4, specifically affecting the config/pw_snmp.html web interface component. This type of vulnerability falls under the CWE-79 category of Cross-Site Scripting, where malicious scripts are injected into web applications and subsequently executed in the context of other users' browsers. The vulnerability manifests through the "System contact" field within the SNMP configuration page, which fails to properly sanitize user input before storing and rendering it back to users.
The technical exploitation of this vulnerability occurs when an attacker submits malicious script code through the vulnerable "System contact" input field in the SNMP configuration interface. When this input is stored in the application's database or configuration files, the script becomes persistent and executes whenever other users view the configuration page. The attack vector is particularly dangerous because it requires no user interaction beyond viewing the affected page, making it a classic stored XSS scenario where the malicious payload is already present in the application's data storage. This vulnerability enables attackers to execute arbitrary JavaScript code in the context of authenticated users' browsers, potentially leading to session hijacking, credential theft, or privilege escalation.
The operational impact of CVE-2019-11370 extends beyond simple script execution, as it can enable attackers to establish persistent access to industrial control systems that rely on Carel pCOWeb for configuration management. The vulnerability affects systems where SNMP configuration data is managed through web interfaces, potentially compromising the integrity of network monitoring and management functions. Attackers could leverage this vulnerability to inject malicious scripts that redirect users to phishing sites, steal session cookies, or modify configuration data to disrupt system operations. The persistence of stored XSS makes this vulnerability particularly dangerous in industrial environments where configuration changes can directly impact operational technology infrastructure.
Organizations should implement immediate mitigations including upgrading to Carel pCOWeb version B1.2.4 or later, which contains the necessary input validation and output encoding fixes. Network segmentation and access controls should be enforced to limit exposure of the vulnerable web interface to untrusted users. Additionally, implementing Content Security Policy headers can provide defense-in-depth against potential exploitation attempts. The vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter, specifically targeting web-based scripting environments. Regular security assessments of industrial control system web interfaces should be conducted to identify similar input validation weaknesses, as this vulnerability demonstrates the critical need for proper sanitization of user inputs in configuration management interfaces.