CVE-2020-15858: Thales BGS5 Path Traversal Vulnerability

CVE-2020-15858 Overview

CVE-2020-15858 is a directory traversal vulnerability affecting multiple Thales DIS (formerly Gemalto, formerly Cinterion) IoT modules. The vulnerability allows physically proximate attackers to circumvent the directory path access check of the internal flash file system. This flash file system stores critical data including application-specific data, customer Java applications, TLS certificates, and OTAP (Java over-the-air-provisioning) functionality.

Critical Impact

Attackers with physical access can bypass file system security controls to access sensitive data including TLS certificates and Java application code stored on affected IoT modules.

Affected Products

• Thales BGS5 up to and including SW RN 02.000 / ARN 01.001.06
• Thales EHSx and PDSx up to and including SW RN 04.003 / ARN 01.000.04
• Thales ELS61 up to and including SW RN 02.002 / ARN 01.000.04
• Thales ELS81 up to and including SW RN 05.002 / ARN 01.000.04
• Thales PLS62 up to and including SW RN 02.000 / ARN 01.000.04

Discovery Timeline

• August 21, 2020 - CVE-2020-15858 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-15858

Vulnerability Analysis

This directory traversal vulnerability (CWE-22) exists in the internal flash file system access control mechanism of Thales DIS IoT cellular modules. The vulnerability stems from insufficient validation of file path inputs, allowing attackers to escape the intended directory boundaries and access protected areas of the flash storage.

The attack requires physical proximity to the vulnerable device, which limits the attack surface but remains significant in deployment scenarios where IoT devices may be installed in accessible locations. Once exploited, an attacker can access sensitive data that should be protected by the file system's access controls.

The impact is particularly concerning because the flash file system stores security-critical data including TLS certificates used for secure communications, Java applications that may contain business logic or credentials, and OTAP provisioning data. Compromise of these elements could lead to broader system compromise, credential theft, or the ability to impersonate legitimate devices.

Root Cause

The root cause is an improper path validation flaw in the internal flash file system's access control mechanism. The path checking routine fails to properly sanitize or validate directory traversal sequences (such as ../) in file path inputs, allowing attackers to navigate outside of permitted directories. This represents a classic directory traversal vulnerability where input validation is insufficient to prevent path escape attempts.

Attack Vector

The attack requires physical access to the affected IoT module. An attacker with such access can craft malicious file path requests that include directory traversal sequences to bypass the intended access restrictions on the flash file system. By escaping the designated directory boundaries, the attacker gains unauthorized access to read or potentially modify sensitive files stored in protected areas of the flash storage.

The exploitation methodology involves sending specially crafted path requests through available interfaces that allow attackers to traverse beyond the intended directory scope. This could potentially be achieved through debug interfaces, AT command interfaces, or other communication channels available when physical access is obtained.

Detection Methods for CVE-2020-15858

Indicators of Compromise

• Unusual access patterns to the internal flash file system on affected IoT modules
• Evidence of directory traversal attempts in device logs (sequences containing ../ or similar patterns)
• Unauthorized modifications to TLS certificates or Java application files
• Unexpected changes to OTAP configuration or provisioning data

Detection Strategies

• Monitor physical access to deployed IoT devices, particularly in uncontrolled environments
• Implement file integrity monitoring on critical flash file system contents where device capabilities permit
• Review device logs for evidence of abnormal file system access patterns or traversal attempts
• Deploy tamper-evident enclosures or physical security controls for IoT devices in accessible locations

Monitoring Recommendations

• Maintain an accurate inventory of all Thales DIS IoT modules deployed in your environment
• Implement regular firmware version audits to identify unpatched devices
• Establish alerting for physical access to IoT device enclosures in sensitive deployments
• Monitor for unauthorized certificate changes or Java application modifications through device management platforms

How to Mitigate CVE-2020-15858

Immediate Actions Required

• Identify all Thales DIS IoT modules in your environment and catalog their firmware versions
• Prioritize firmware updates for devices in physically accessible or uncontrolled locations
• Implement physical security controls to restrict unauthorized access to affected devices
• Review and backup current TLS certificates and Java applications before applying updates

Patch Information

Thales has released firmware updates to address this vulnerability. Organizations should consult the Thales Security Updates for Cinterion IoT Modules page for specific patched firmware versions for each affected product line.

The following minimum firmware versions should be applied:

• BGS5: Firmware versions after SW RN 02.000 / ARN 01.001.06
• EHSx and PDSx: Firmware versions after SW RN 04.003 / ARN 01.000.04
• ELS61: Firmware versions after SW RN 02.002 / ARN 01.000.04
• ELS81: Firmware versions after SW RN 05.002 / ARN 01.000.04
• PLS62: Firmware versions after SW RN 02.000 / ARN 01.000.04

Workarounds

• Deploy affected IoT devices in physically secured enclosures to prevent unauthorized physical access
• Implement tamper detection mechanisms where available to alert on physical access attempts
• Disable or restrict unnecessary interfaces that could be used for exploitation when physical access is obtained
• Consider network segmentation to limit the impact if device credentials are compromised

# Firmware version verification example
# Check current firmware version via AT command interface
AT^SIND
# Review device inventory for affected firmware versions
# Consult Thales documentation for product-specific version commands