CVE-2024-6071: PTC Creo Elements/Direct RCE Vulnerability

CVE-2024-6071 Overview

PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server. This command injection vulnerability represents a severe security risk for organizations utilizing PTC's industrial design software licensing infrastructure, as attackers can achieve complete system compromise without requiring any authentication credentials.

Critical Impact

Unauthenticated remote command execution allows attackers to fully compromise affected license servers, potentially leading to lateral movement across industrial networks, data exfiltration, and disruption of CAD/PLM operations.

Affected Products

• PTC Creo Elements/Direct License Server (affected versions detailed in vendor advisory)

Discovery Timeline

• 2024-06-27 - CVE-2024-6071 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6071

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the License Server's web interface fails to implement proper access controls before processing user-supplied input. The exposed web interface accepts commands that are subsequently executed at the operating system level without any authentication or authorization checks. This architectural flaw allows any network-reachable attacker to interact with the vulnerable endpoint and execute arbitrary commands with the privileges of the License Server process.

The vulnerability is particularly concerning in industrial environments where license servers are often deployed on internal networks with elevated privileges to manage software licensing across multiple workstations and servers.

Root Cause

The root cause of CVE-2024-6071 is the absence of authentication and authorization controls (CWE-862) on the web interface exposed by the PTC Creo Elements/Direct License Server. The application accepts and processes commands from the network without verifying the identity or permissions of the requesting party. Combined with inadequate input sanitization, this allows user-supplied data to be passed directly to system command execution functions.

Attack Vector

The attack vector is network-based, requiring no authentication, user interaction, or special privileges. An attacker with network access to the License Server's web interface can craft malicious HTTP requests containing OS commands. These commands are processed by the server and executed in the context of the License Server process. The attack can be launched remotely against any exposed instance, making internet-facing deployments especially vulnerable.

The exploitation flow typically involves:

1. Identifying an exposed PTC Creo Elements/Direct License Server web interface
2. Crafting HTTP requests with embedded OS commands
3. Submitting the malicious requests to the vulnerable endpoint
4. Commands execute on the server with the privileges of the License Server service

For detailed technical information, refer to the CISA ICS Advisory ICSA-24-177-02 and PTC Support Article CS417607.

Detection Methods for CVE-2024-6071

Indicators of Compromise

• Unexpected outbound network connections from the License Server to unknown external hosts
• Unusual process spawning from the License Server process (e.g., cmd.exe, powershell.exe, /bin/sh, /bin/bash)
• HTTP requests to the License Server web interface containing shell metacharacters or command syntax
• Creation of unexpected files or user accounts on the License Server host

Detection Strategies

• Monitor web server access logs for the License Server interface, looking for requests with suspicious characters such as ;, |, &&, $(), or backticks
• Implement network intrusion detection rules to identify command injection patterns in HTTP traffic destined for license server ports
• Deploy endpoint detection and response (EDR) solutions to identify anomalous child processes spawned by the License Server application
• Configure application whitelisting to alert on unauthorized binaries executed by the License Server service account

Monitoring Recommendations

• Establish baseline behavior for the License Server and alert on deviations such as new network connections or process activity
• Integrate License Server logs with SIEM solutions for centralized monitoring and correlation
• Implement file integrity monitoring on the License Server host to detect unauthorized modifications
• Review and audit network access to the License Server web interface regularly

How to Mitigate CVE-2024-6071

Immediate Actions Required

• Restrict network access to the PTC Creo Elements/Direct License Server web interface using firewalls and access control lists
• Isolate the License Server on a segmented network with limited connectivity to critical systems
• Apply the security patch from PTC as soon as available (refer to PTC Support Article CS417607)
• Audit License Server hosts for signs of compromise before and after patching

Patch Information

PTC has released security guidance for this vulnerability. Organizations should consult the PTC Support Article CS417607 for specific patch details and update instructions. Additionally, CISA has published ICS Advisory ICSA-24-177-02 with recommended mitigations for industrial control system environments.

Workarounds

• Implement strict firewall rules to limit access to the License Server web interface to only authorized management hosts
• Deploy a reverse proxy or web application firewall (WAF) with command injection detection capabilities in front of the License Server
• Disable or block the vulnerable web interface if not required for normal operations
• Run the License Server with minimal privileges to limit the impact of successful exploitation

# Example firewall rule to restrict License Server access (Linux iptables)
# Allow access only from trusted management subnet
iptables -A INPUT -p tcp --dport <LICENSE_SERVER_PORT> -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <LICENSE_SERVER_PORT> -j DROP