CVE-2018-10591

Vulnerability

Advantech WebAccess versions V8.2_20170817 and prior, V8.3.0 and prior, Dashboard V.2.0.15 and prior, Scada Node prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior contain an origin validation error vulnerability (CWE-346). The application fails to properly validate the Origin header in cross-origin requests, allowing a malicious website to perform actions on behalf of an authenticated user. [1]

Exploitation

An attacker can host a malicious website that, when visited by an authenticated WebAccess user, makes cross-origin requests to the WebAccess server. The server does not validate the origin, enabling the attacker to steal the user's session cookies. No authentication or prior access is required for the attacker; the attack is remotely exploitable. [1]

Impact

Successful exploitation allows the attacker to steal session cookies of authenticated users, leading to unauthorized access to the WebAccess application and its data. This compromises confidentiality and integrity of user data, potentially allowing full control of the application. [1]

Mitigation

Advantech has released updates to address this vulnerability: WebAccess V8.2_20180418, V8.3.1, Dashboard V2.0.16, Scada Node V8.3.1, and WebAccess/NMS V2.0.4. Users should upgrade to these versions or later. As a workaround, restrict network access to the WebAccess server and avoid browsing untrusted websites while authenticated. [1]