CVE-2019-19875

B&R APROL allows root-level access via AprolCluster script (CVE-XXXXX)

• CVSS 9.8
• CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
• Input Validation and Sanitization
• Local

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.

CVE

CVE-2019-19875

CWE

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVSS base score

9.8

Published

2020-11-27

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update B&R Industrial Automation APROL to version R4.2 V7.08 or higher.

def calculate(expression):
    """Calculate expression - VULNERABLE to code injection"""
    # VULNERABILITY: eval() executes arbitrary Python code
    return eval(expression)

# Example exploitation:
# calculate("__import__('os').system('whoami')")

import ast
import operator

def calculate_secure(expression):
    """Securely calculate mathematical expression"""
    try:
        # Parse expression into AST
        tree = ast.parse(expression, mode='eval')
        return eval_ast_node(tree.body)
    except:
        return None

def eval_ast_node(node):
    """Safely evaluate AST node"""
    if isinstance(node, ast.Constant):
        return node.value
    elif isinstance(node, ast.BinOp):
        left = eval_ast_node(node.left)
        right = eval_ast_node(node.right)
        ops = {ast.Add: operator.add, ast.Sub: operator.sub}
        return ops[type(node.op)](left, right)
    else:
        raise ValueError("Unsupported operation")

@misc{vaitp:cve201919875,
  title        = {{B&R APROL allows root-level access via AprolCluster script (CVE-XXXXX)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-19875},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-19875/}}
}