CVE-2024-21852: Rapid SCADA Zip Slip RCE Vulnerability

CVE-2024-21852 Overview

CVE-2024-21852 is a Path Traversal vulnerability affecting Rapid Software LLC's Rapid SCADA, an open-source industrial automation platform used for supervisory control and data acquisition (SCADA) systems. The vulnerability exists in versions prior to 5.8.4 and stems from a Zip Slip flaw in the unpacking routine that processes configuration files. An attacker can exploit this vulnerability by supplying a malicious configuration file containing specially crafted archive entries with directory traversal sequences, allowing arbitrary file writes outside the intended extraction directory and ultimately achieving remote code execution.

Critical Impact

This vulnerability allows attackers with low privileges to achieve remote code execution on SCADA systems, potentially compromising critical industrial control infrastructure and operational technology environments.

Affected Products

• Rapid SCADA versions prior to 5.8.4
• Rapidscada Rapid SCADA (all platforms)
• Industrial control systems utilizing vulnerable Rapid SCADA deployments

Discovery Timeline

• 2024-01-11 - CISA ICS Advisory ICSA-24-011-03 published
• 2024-02-01 - CVE-2024-21852 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21852

Vulnerability Analysis

This vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'). The flaw resides in the configuration file unpacking mechanism within Rapid SCADA, which fails to properly sanitize file paths contained within uploaded archive files.

The Zip Slip attack technique exploits archive extraction routines that do not validate file paths before writing extracted content to disk. When a malicious archive contains entries with relative path sequences such as ../, the extraction routine writes files outside the intended destination directory. In the context of Rapid SCADA, this allows an attacker to overwrite critical system files, inject malicious executables, or place web shells in accessible locations.

Given that Rapid SCADA is deployed in industrial control system (ICS) environments, successful exploitation could have severe consequences for operational technology infrastructure, potentially affecting physical processes and safety systems.

Root Cause

The root cause of CVE-2024-21852 is inadequate input validation in the archive extraction functionality. The vulnerable code fails to canonicalize and validate file paths extracted from configuration archive files before writing them to the filesystem. Specifically, the unpacking routine does not:

1. Check for directory traversal sequences (../ or ..\) in archive entry names
2. Verify that the resolved extraction path remains within the intended destination directory
3. Reject archive entries with absolute paths or symbolic links that could escape the extraction boundary

Attack Vector

The attack is network-based and requires low privileges to execute. An authenticated attacker can exploit this vulnerability through the following attack flow:

1. Craft a malicious ZIP archive containing files with path traversal sequences in their names (e.g., ../../../../var/www/html/shell.php)
2. Upload the malicious archive through the Rapid SCADA configuration import functionality
3. When the server processes and extracts the archive, files are written to arbitrary locations on the filesystem
4. The attacker can then access the planted malicious files to achieve code execution

The vulnerability mechanism involves crafting archive entries where the filename contains directory traversal sequences. When extracted, these paths resolve outside the intended extraction directory. For example, an archive entry named ../../../tmp/malicious.sh would be extracted to /tmp/malicious.sh rather than within the configuration directory. For detailed technical information, refer to the CISA ICS Advisory ICSA-24-011-03.

Detection Methods for CVE-2024-21852

Indicators of Compromise

• Unexpected files appearing outside the Rapid SCADA configuration directories
• Web shells or executable files in web-accessible directories
• Modified system files or startup scripts that were not administratively changed
• Archive extraction operations writing to paths containing ../ sequences in logs
• Unauthorized configuration uploads from unusual IP addresses or user accounts

Detection Strategies

• Monitor file system activity for writes outside the expected Rapid SCADA installation and configuration directories during archive extraction operations
• Implement file integrity monitoring (FIM) on critical system directories and Rapid SCADA installation paths
• Analyze web server and application logs for configuration upload requests followed by suspicious file access patterns
• Deploy endpoint detection rules to alert on archive extraction operations that attempt to write files using path traversal patterns

Monitoring Recommendations

• Enable detailed logging for all configuration file uploads and archive extraction operations in Rapid SCADA
• Implement network segmentation monitoring to detect lateral movement from compromised SCADA systems
• Configure SIEM rules to correlate configuration upload events with subsequent unexpected file creation events
• Monitor for process execution from non-standard directories, particularly those reachable via traversal from the configuration path

How to Mitigate CVE-2024-21852

Immediate Actions Required

• Upgrade Rapid SCADA to version 5.8.4 or later immediately
• Audit configuration upload logs for any suspicious activity prior to patching
• Perform file integrity checks on critical system directories to identify potential compromise
• Restrict network access to Rapid SCADA administrative interfaces to trusted networks only
• Review and minimize user accounts with configuration upload privileges

Patch Information

Rapid Software LLC has addressed this vulnerability in Rapid SCADA version 5.8.4. Organizations should upgrade to this version or later to remediate CVE-2024-21852. The patch implements proper path validation during archive extraction to prevent directory traversal attacks. For upgrade assistance and additional information, contact the vendor through the Rapid SCADA Contact Page.

Workarounds

• Implement network-level access controls to restrict configuration upload functionality to trusted administrative workstations only
• Deploy a web application firewall (WAF) or reverse proxy that can inspect archive uploads for path traversal patterns
• Configure file system permissions to prevent the Rapid SCADA service account from writing outside its designated directories
• Temporarily disable the configuration import feature if not required for operations until patching can be completed

# Example: Restrict network access to Rapid SCADA admin interface using iptables
# Replace 192.168.1.0/24 with your trusted admin network
iptables -A INPUT -p tcp --dport 10008 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 10008 -j DROP

# Verify Rapid SCADA version after upgrade
cat /opt/scada/ScadaServer/version.txt