Codesys Runtime Improper Limitation of a Pathname

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• codesys control for beaglebone3.0.0.0 and later · before 3.5.12.30
• codesys control for empc-a/imx63.0.0.0 and later · before 3.5.12.30
• codesys control for iot20003.0.0.0 and later · before 3.5.12.30
• codesys control for pfc1003.0.0.0 and later · before 3.5.12.30
• codesys control for pfc2003.0.0.0 and later · before 3.5.12.30
• codesys control for raspberry pi3.0.0.0 and later · before 3.5.12.30
• codesys control rte3.0.0.0 and later · before 3.5.12.30
• codesys control v3 runtime system toolkit3.0.0.0 and later · before 3.5.12.30
• codesys control win3.0.0.0 and later · before 3.5.12.30
• codesys embedded target visu toolkit3.0 and later · before 3.5.12.30
• codesys hmi3.0 and later · before 3.5.12.30
• codesys remote target visu toolkit3.0 and later · before 3.5.12.30
• codesys runtime plcwinnt2.0.0.0 and later · before 2.4.7.52
• codesys runtime system toolkit2.0.0.0 and later · before 2.4.7.52
• codesys runtime system toolkit3.5.15.0
• codesys simulation runtime3.0.0.0 and later · before 3.5.12.30

Versions reported by the vendor

Affected version ranges reported by the assigning authority (CERTVDE). Independent of NVD's CPE analysis and usually ahead of it.

• CODESYS Control for BeagleBone

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS Control for emPC-A/iMX6

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS Control for IOT2000

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS Control for PFC100

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS Control for PFC200

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS Control for Raspberry Pi

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS Control RTE V3 (all variants)

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS Control V3 Runtime System Toolkit

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS Control Win V3 (all variants)

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS HMI V3 (all variants)

  • 3.0.0.0 and later · before 3.5.12.30affected

• CODESYS Runtime PLCWinNT

  • 2.0.0.0 and later · before 2.4.7.52affected

• CODESYS Runtime Toolkit 32 bit embedded

  • 2.0.0.0 and later · before 2.3.2.10affected

Other highest-scoring records for the same primary product.

• CVE-2019-13548CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could caus
  41Plan
• CVE-2020-10245CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
  40Plan
• CVE-2019-18858CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
  40Plan
• CVE-2019-9008An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30.
  36Monitor
• CVE-2020-12069CODESYS V3 prone to Inadequate Password Hashing
  31Monitor
• CVE-2020-15806CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.