Triangle MicroWorks SCADA Data Gateway 目录遍历任意文件创建漏洞

该目录遍历漏洞允许攻击者通过构造恶意请求，在 SCADA Data Gateway 服务器的文件系统中创建任意文件。这可能导致系统配置被篡改，恶意代码被植入，甚至可能导致远程代码执行。攻击者可以利用此漏洞获取敏感信息，例如数据库凭据、配置信息等，并进一步控制整个 SCADA 系统。由于 SCADA 系统通常用于控制关键基础设施，因此该漏洞可能对电力、水务、交通等行业造成严重影响。此漏洞的利用方式类似于其他目录遍历漏洞，攻击者通过精心构造的文件路径，绕过安全检查，访问未授权的资源。

Organizations utilizing Triangle MicroWorks SCADA Data Gateway in industrial control systems are at risk. This includes critical infrastructure sectors such as energy, water treatment, and manufacturing. Specifically, deployments with limited network segmentation and inadequate file system monitoring are particularly vulnerable. Shared hosting environments where multiple SCADA systems reside on the same infrastructure also increase the potential impact.

• linux / server: Monitor system logs (journalctl) for unusual file creation events, particularly in sensitive directories. Look for patterns indicative of directory traversal attempts.

journalctl -f | grep -i 'create file' -i 'directory traversal'

• generic web: Use curl to test for directory traversal by appending path traversal sequences (e.g., ../../../../) to the vulnerable endpoint. Analyze response headers and content for signs of unauthorized file access.

curl 'http://<scada_gateway_ip>/workspace/../../../../etc/passwd' -s

• windows / supply-chain: Monitor PowerShell execution logs for suspicious commands involving file creation or modification within the SCADA Data Gateway's installation directory.

Get-WinEvent -LogName Security -FilterXPath '//Event[System[EventID=4688] and EventData[Data[@Name='ProcessName']='powershell.exe'] and EventData[Data[@Name='CommandLine'] like '%create file%']]'

1. 2024-05-03Disclosure

   disclosure

1. 已保留2023-08-02
2. 发布日期2024-05-03
3. 修改日期2024-08-02
4. EPSS 更新日期2026-04-02

由于目前没有官方提供的补丁版本，建议采取以下缓解措施：首先，限制对 SCADA Data Gateway 的访问，只允许授权用户访问。其次，实施严格的文件访问控制，确保用户只能访问其授权的文件和目录。第三，对所有输入数据进行严格的验证和过滤，防止攻击者注入恶意代码。第四，部署 Web 应用防火墙 (WAF) 或代理服务器，拦截恶意请求。第五，定期扫描系统漏洞，及时发现和修复安全问题。在采取缓解措施后，建议检查系统日志，确认是否存在异常活动。