Security Advisory

Multiple vulnerabilities in the web server
1 Advisory Information
Advisory ID: BOSCH-SA-741752
CVE Numbers and CVSS v3.1 Scores: CVE-2021-23855
o Base Score: 8.6 (High) CVE-2021-23856

o Base Score: 10.0 (Critical)

 CVE-2021-23857

o Base Score: 10.0 (Critical)

 CVE-2021-23858

o Base Score: 8.6 (High)

Published: 30 Sep 2021

Last Updated: 25 Aug 2022

2 SummaryThe control systems series Rexroth IndraMotion MLC and IndraLogic XLC are affected by multiple vulnerabilities
in the web server, which – in combination – ultimately enable an attacker to log in to the system.
 Information disclosure: The main configuration, including users and their hashed passwords, is exposed byan unprotected web server resource, and can be accessed without authentication. Additionally, device details
are exposed which include the serial number and the firmware version by another unprotected web server
resource.
 Login with hash: The login routine allows the client to log in to the system not by using the password, but by
using the hash of the password. Additionally, the authentication is handled by the client and not by the server.
Combined with the aforementioned vulnerability, this allows an attacker to subsequently login to the system
The control systems Rexroth IndraMotion MLC are affected by multiple further vulnerabilities in the web server.
 Information disclosure: The user and password data base are exposed by an unprotected web server
resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine
the password by using rainbow tables
 Reflected Cross-Site-Scripting: The web server is vulnerable to reflected XSS and therefore an attacker
might be able to execute scripts on a client’s computer by sending the client a manipulated URL.
These vulnerabilities were discovered and reported by Matan Dobrushin and Eran Jacob from OTORIO
Research as well as from Fady Oueslati.

Copyright © 2021 Bosch Rexroth AG

Security Advisory BOSCH-SA-741752

3 Affected Products IndraMotion MLC IndraMotion XLC
o CVE-2021-23855

 IndraMotion MLC L20, L40
o CVE-2021-23856

 IndraMotion MLC L20, L40 >= 12 VRSo CVE-2021-23857

o CVE-2021-23858

 IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraControl XLC >= 12 VRSo CVE-2021-23858

 IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraMotion XLC >= 12 VRSo CVE-2021-23857

4 Solution
4.1

Use of a security gateway

Use of a security gateway, e.g. the ctrlX CORE, for the protection of the affected products or replace the affectedproducts. The IndraMotion and IndraLogic series are not intended to be used in open networks and therefore
requires protection by external devices.

4.2

Compensatory Measures

In general, compensatory measures are strongly advised which mitigate the risk. Always define suchcompensatory measures individually, in the context of the operational environment. Some measures aredescribed in the “Security Guideline Electric Drives and Controls”, for example the network segmentation (pleasesee [1]). In general, it is mandatory to implement the measures described in the “Security Guideline ElectricDrives and Controls”.

5 Vulnerability Details
5.1

CVE-2021-23855

CVE description: The user and password data base is exposed by an unprotected web server resource.
Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password
by using rainbow tables.
 Problem Type:o CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
 CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:No Base Score: 8.6 (High)Copyright © 2021 Bosch Rexroth AG

Page 2 of 3

Security Advisory BOSCH-SA-741752

5.2

CVE-2021-23856

CVE description: The web server is vulnerable to reflected XSS and therefore an attacker might be able toexecute scripts on a client’s computer by sending the client a manipulated URL.
 Problem Type:o CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
o Base Score: 10.0 (Critical)

5.3

CVE-2021-23857

CVE description: Login with hash: The login routine allows the client to log in to the system not by using thepassword, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker tosubsequently login to the system.
 Problem Type:o CWE-836 Use of Password Hash Instead of Password for Authentication
 CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Ho Base Score: 10.0 (Critical)

5.4

CVE-2021-23858

CVE description: Information disclosure: The main configuration, including users and their hashed passwords, isexposed by an unprotected web server resource, and can be accessed without authentication. Additionally,device details are exposed which include the serial number and the firmware version by another unprotected
web server resource.
 Problem Type:o CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
 CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:No Base Score: 8.6 (High)

6 Additional Resources[1] Security Guideline Electric Drives and Controls:
https://www.boschrexroth.com/de/de/myrexroth/media-directory-download?object_nr=R911342562

7 Revision History
25 Aug 2022: Update the advisory - Extend description for login with hash and add additional researcher
30 Sep 2021: Initial Publication

Copyright © 2021 Bosch Rexroth AGPage 3 of 3