CVE-2021-27473 : Security Advisory and Response

Rockwell Automation Connected Components Workbench v12.00.00 and earlier versions have a vulnerability allowing a local, authenticated attacker to gain admin level privileges by executing a malicious archive file. The vulnerability is due to improper validation of input paths, allowing for a Zip Slip attack.

Understanding CVE-2021-27473

This CVE involves an improper input validation vulnerability in the Connected Components Workbench software by Rockwell Automation.

What is CVE-2021-27473?

The vulnerability in Connected Components Workbench v12.00.00 and prior versions allows a local attacker to exploit a malicious archive file, potentially gaining admin privileges.

The Impact of CVE-2021-27473

This vulnerability can lead to privilege escalation, enabling an attacker to gain unauthorized access to sensitive system resources.

Technical Details of CVE-2021-27473

The following technical details outline the specifics of the CVE

Vulnerability Description

The issue arises from the software's failure to properly sanitize paths within the .ccwarc archive file during extraction, a common exploit known as a Zip Slip.

Affected Systems and Versions

Rockwell Automation Connected Components Workbench versions up to v12.00.00 are impacted by this vulnerability.

Exploitation Mechanism

A local, authenticated attacker can craft a malicious .ccwarc archive file to exploit the vulnerability upon extraction, potentially gaining privileges.

Mitigation and Prevention

To address this vulnerability, consider the following mitigation strategies:

Immediate Steps to Take

Update to the latest software revision (Connected Components Workbench v13.00.00 or later).
Run Connected Components Workbench with minimal user privileges.
Avoid opening untrusted .ccwarc files to mitigate risks.

Long-Term Security Practices

Educate users about social engineering attacks and phishing warnings.
Implement least-privilege principles for user access.

Patching and Updates

For more information and detailed mitigation steps, refer to Rockwell Automation's industrial security advisory.