Submit #157: Claroty SRA <2.0.1 - unauthenticated port scan

Claroty Secure Remote Access (SRA) is used to manage access to OT/ICS networks. In SRA version < 2.0.1 it is possible for an unauthenticated remote attacker to perform port scans of the internal OT/ICS network using the /server_statuses function.

In order to take advantage of this vulnerability an attacker must know the site_name by default this is 'central' for the DMZ and 'Central' for the OT network.

Example:

‘/servers_statuses?ip=10.10.10.10&port=445&protocol=tcp&site_name=Central’

• User: Standlt6 (UID 10185)
• Submission: 03/06/2020 17:35 (6 years ago)
• Moderation: 08/10/2020 10:47 (5 months later)
• Status: Accepted
• VulDB entry: 159428
• Points: 17