CVE-2019-19102 in Automation Studio
Summary
by MITRE
A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/06/2025
The vulnerability identified as CVE-2019-19102 represents a critical directory traversal flaw within SharpZipLib, a widely used .NET compression library that serves as the foundation for B&R Automation Studio's upgrade service functionality. This security weakness specifically affects versions 4.0.x, 4.1.x, and 4.2.x of the automation software, creating a significant risk for industrial control systems and embedded environments where these tools are deployed. The vulnerability operates under the well-known moniker "zip slip" which describes the exploitation technique where maliciously crafted archive files can cause arbitrary file writes on the target system through improper path handling during decompression operations.
The technical flaw manifests in how SharpZipLib processes archive file entries during extraction, particularly when handling filenames that contain directory traversal sequences such as "../" or similar path manipulation patterns. When the upgrade service in B&R Automation Studio processes compressed files containing such malicious paths, the decompression routine fails to properly validate or sanitize the target file paths, allowing attackers to write files to arbitrary locations on the system. This behavior directly maps to CWE-22, which defines improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal vulnerabilities. The vulnerability's impact extends beyond simple file access as it enables potential privilege escalation and system compromise through the creation of malicious files in critical system directories.
Operationally, this vulnerability creates a severe risk for industrial environments where B&R Automation Studio is deployed, as unauthenticated attackers can exploit this weakness to place malicious files in system directories, potentially leading to persistent backdoors, privilege escalation, or system corruption. The implications are particularly concerning in industrial control systems where these automation tools are used for critical infrastructure management, as the ability to write arbitrary files could enable attackers to compromise the integrity of control systems. The vulnerability's exposure through the upgrade service interface means that even without authentication, attackers can leverage this weakness to gain unauthorized system access, making it a high-severity threat for environments where physical security is inadequate or where network exposure occurs.
Mitigation strategies for CVE-2019-19102 should prioritize immediate patching of affected B&R Automation Studio versions to address the underlying SharpZipLib vulnerability. Organizations should implement network segmentation to limit access to systems running affected software and disable unnecessary upgrade service functionality where possible. The implementation of proper input validation and path sanitization measures within the application code can provide additional defense-in-depth layers. Security monitoring should focus on detecting unusual file creation patterns in system directories and unauthorized access attempts to upgrade services. This vulnerability aligns with ATT&CK technique T1059.007 for execution through scriptlets and T1078 for valid accounts usage, as attackers may leverage this vulnerability to establish persistent access through file injection attacks. Organizations should also consider implementing application whitelisting policies to restrict execution of potentially malicious files and maintain regular security assessments of industrial control system environments to identify similar path traversal vulnerabilities in other software components.