{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Sharon Briznov"
        ],
        "organization": "Claroty",
        "summary": "reporting these vulnerabilities to GE"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could result in data exfiltration or arbitrary write, overwrite, and execution.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Communications, Critical Manufacturing, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-025-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-025-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-025-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-025-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
      }
    ],
    "title": "GE Gas Power ToolBoxST",
    "tracking": {
      "current_release_date": "2022-01-25T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-025-01",
      "initial_release_date": "2022-01-25T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-01-25T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-22-025-01 GE Gas Power ToolBoxST"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 07.09.07C",
                "product": {
                  "name": "ToolBoxST OS: All versions prior to 07.09.07C",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "ToolBoxST OS"
          }
        ],
        "category": "vendor",
        "name": "General Electric (GE)"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44477",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.CVE-2021-44477 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44477"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "GE addressed CVE-2021-44477 in ToolBoxST OS Version 07.09.07C and above by disabling the use of DTD\u0027s, which are not necessary for ToolBoxST functionality.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44477"
        },
        {
          "category": "mitigation",
          "details": "Users should ensure they follow the password protection and network segmentation guidance laid out in GEH-6839 Secure Deployment Guide. Additionally, the use of SDI Secure Mode offers considerable protection against this attack as the threat actor must be able to perform a download to the controller over SDI. Secure Mode validates authenticity and protects against spoofing of SDI commands.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "GE Gas Power Cybersecurity and Engineering teams will continue to investigate internally as well as monitor industry-based news for any changes or updates. To reduce the risk vulnerabilities such as these may represent to the controls network, GE recommends the implementation of a good defense-in-depth strategy as detailed in GEH-6839. Some recommended controls include:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all controllers with the use of network segmentation, placement of controllers behind controls network firewalls and ensure they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Block suspicious external IP addresses at the controls network firewalls. Monitor traffic internally for unusual behavior.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement defense-in-depth within the controls network environment consisting of tools such as Intrusion detection/prevention systems (IDS/IPS), firewalls, and network access control (NAC).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement and maintain an anti-malware solution and an endpoint detection and response (EDR) solution.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Disable remote access services and protocols such as remote desktop protocol (RDP) unless needed. Monitor and restrict remote access usage on a least-privilege basis.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Have backup and restore processes and procedures in place for disaster recovery and incident response.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Monitor and maintain account provisioning and access control based on the principle of least privilege.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information, please see the GE advisory on the GE security page. Users can also contact GE Power PSIRT for specific mitigations.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-01-20_GE_Gas_Power_Product_Security_Advisory-Vulnerabilities_in_ToolBoxST.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2018-16202",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ToolBoxST prior to Version 7.8.0 uses a vulnerable version of the Ionic .NET Zip library that does not properly sanitize path names allowing files to be extracted to a location above their parent directory and back to the root directory. If an attacker compromises an HMI or creates their own SDI client, they can upload the device.zip file from a controller, patch it to contain a malicious file and path, and download it back to the controller. The next user to perform an upload could grab the malicious device.zip and extract it to their HMI, creating the potential for arbitrary write, overwrite, and execution.CVE-2018-16202 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16202"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "GE upgraded the Ionic library in ToolBoxST Version 7.8.0 to resolve CVE-2018-16202",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16202"
        },
        {
          "category": "mitigation",
          "details": "Users should ensure they follow the password protection and network segmentation guidance laid out in GEH-6839 Secure Deployment Guide. Additionally, the use of SDI Secure Mode offers considerable protection against this attack as the threat actor must be able to perform a download to the controller over SDI. Secure Mode validates authenticity and protects against spoofing of SDI commands.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "GE Gas Power Cybersecurity and Engineering teams will continue to investigate internally as well as monitor industry-based news for any changes or updates. To reduce the risk vulnerabilities such as these may represent to the controls network, GE recommends the implementation of a good defense-in-depth strategy as detailed in GEH-6839. Some recommended controls include:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all controllers with the use of network segmentation, placement of controllers behind controls network firewalls and ensure they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Block suspicious external IP addresses at the controls network firewalls. Monitor traffic internally for unusual behavior.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement defense-in-depth within the controls network environment consisting of tools such as Intrusion detection/prevention systems (IDS/IPS), firewalls, and network access control (NAC).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement and maintain an anti-malware solution and an endpoint detection and response (EDR) solution.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Disable remote access services and protocols such as remote desktop protocol (RDP) unless needed. Monitor and restrict remote access usage on a least-privilege basis.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Have backup and restore processes and procedures in place for disaster recovery and incident response.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Monitor and maintain account provisioning and access control based on the principle of least privilege.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information, please see the GE advisory on the GE security page. Users can also contact GE Power PSIRT for specific mitigations.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-01-20_GE_Gas_Power_Product_Security_Advisory-Vulnerabilities_in_ToolBoxST.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}