CVE-2022-23854: Aveva InTouch Path Traversal Vulnerability

CVE-2022-23854 Overview

CVE-2022-23854 is a path traversal vulnerability affecting AVEVA InTouch Access Anywhere versions 2020 R2 and older. This security flaw allows an unauthenticated user with network access to read arbitrary files on the system outside of the secure gateway web server's intended directory scope. The vulnerability poses significant risk to industrial control system (ICS) environments where AVEVA InTouch Access Anywhere is commonly deployed for remote HMI access.

Critical Impact

Unauthenticated attackers can exploit this path traversal vulnerability to access sensitive configuration files, credentials, and system data on affected AVEVA InTouch Access Anywhere deployments, potentially compromising industrial control system environments.

Affected Products

• AVEVA InTouch Access Anywhere 2020 R2
• AVEVA InTouch Access Anywhere 2020
• AVEVA InTouch Access Anywhere versions prior to 2020 R2

Discovery Timeline

• 2022-12-23 - CVE-2022-23854 published to NVD
• 2025-02-13 - Last updated in NVD database

Technical Details for CVE-2022-23854

Vulnerability Analysis

This path traversal vulnerability (CWE-22, CWE-23) exists within the AVEVA InTouch Access Anywhere Secure Gateway web server component. The vulnerability allows attackers to escape the web server's document root directory by manipulating file path inputs, enabling access to files located elsewhere on the host system. Since the attack requires no authentication, any network-accessible deployment is at risk. The vulnerability specifically affects the confidentiality of the system, allowing unauthorized read access to sensitive files including configuration data, credentials, and potentially proprietary industrial process information.

Root Cause

The root cause of CVE-2022-23854 is insufficient input validation on user-supplied file paths within the AVEVA InTouch Access Anywhere Secure Gateway web server. The application fails to properly sanitize path traversal sequences (such as ../ or encoded variants) before processing file requests. This allows attackers to construct malicious requests that navigate outside the intended web root directory and access arbitrary files on the underlying file system with the permissions of the web server process.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to an exposed AVEVA InTouch Access Anywhere Secure Gateway can craft HTTP requests containing path traversal sequences to read files outside the web server's document root. Typical attack patterns involve manipulating URL parameters or request paths to include directory traversal sequences that resolve to sensitive system files such as configuration files, password stores, or application data. The attack can be executed remotely against any network-accessible instance.

The vulnerability mechanism involves improper handling of directory traversal sequences in HTTP requests. Attackers craft requests containing sequences like ../ or URL-encoded equivalents (%2e%2e%2f) to escape the web root directory and access files elsewhere on the filesystem. For detailed technical information, refer to the Crisec Advisory and CISA ICS Advisory ICSA-22-342-02.

Detection Methods for CVE-2022-23854

Indicators of Compromise

• HTTP requests to the AVEVA InTouch Access Anywhere Secure Gateway containing ../ or encoded path traversal sequences (%2e%2e%2f, %252e%252e%252f)
• Web server access logs showing attempts to access files outside normal application paths such as /etc/passwd, C:\Windows\win.ini, or application configuration files
• Unusual file access patterns from the web server process accessing sensitive system directories
• Network traffic analysis revealing HTTP responses containing system file contents

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block path traversal sequences in incoming requests to AVEVA InTouch Access Anywhere
• Implement IDS/IPS signatures targeting directory traversal patterns in HTTP traffic destined for known AVEVA deployment ports
• Enable verbose logging on the Secure Gateway web server and configure SIEM alerts for path traversal indicators
• Use SentinelOne Singularity to monitor for anomalous file access patterns from web server processes

Monitoring Recommendations

• Monitor AVEVA InTouch Access Anywhere web server logs for requests containing encoded or decoded path traversal characters
• Configure alerting for any file read operations by the web server process outside of expected directories
• Establish network monitoring for unusual outbound data transfers from AVEVA systems that may indicate data exfiltration
• Review access logs regularly for reconnaissance activity targeting the Secure Gateway component

How to Mitigate CVE-2022-23854

Immediate Actions Required

• Identify all AVEVA InTouch Access Anywhere deployments running version 2020 R2 or earlier
• Apply network segmentation to restrict access to AVEVA InTouch Access Anywhere Secure Gateway to authorized users only
• Review web server and system logs for evidence of exploitation attempts
• Consider temporarily disabling external access to vulnerable deployments until patches can be applied

Patch Information

AVEVA has released security updates addressing this vulnerability. Refer to the Aveva Security Bulletin AVEVA-2023-001 for official patch information and upgrade instructions. Organizations should upgrade to a patched version of AVEVA InTouch Access Anywhere as soon as possible. Additionally, CISA has published ICS Advisory ICSA-22-342-02 with detailed mitigation guidance.

Workarounds

• Implement strict network access controls to limit connectivity to the AVEVA InTouch Access Anywhere Secure Gateway to trusted IP addresses only
• Deploy a reverse proxy or web application firewall (WAF) in front of vulnerable deployments to filter path traversal attempts
• If remote access is not required, disable or firewall the Secure Gateway component until patching is complete
• Use VPN-only access for remote connections to minimize attack surface exposure

# Example firewall rule to restrict access to AVEVA InTouch Access Anywhere
# Replace 10.0.0.0/24 with your authorized network range
# Replace 443 with the actual port used by your deployment

# Linux iptables example
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP