How to remediate – Advantech WebAccess Web Administration Interface Detection

1. Introduction

The remote host is running a web administration interface for Advantech WebAccess, a SCADA HMI solution. This means an attacker could potentially gain access to the system and control industrial processes. Systems commonly affected are those using Advantech WebAccess for managing their SCADA infrastructure. A successful exploit could lead to loss of confidentiality, integrity, and availability of critical systems.

2. Technical Explanation

The vulnerability lies in the presence of a web administration interface exposed on the network. This interface allows remote management of the WebAccess HMI solution. An attacker with network access can attempt to exploit vulnerabilities within this interface. There is no CVE associated with this detection, but it flags a potentially high-risk exposure. For example, an attacker could use default credentials or known exploits to gain unauthorized control.

• Root cause: The web administration interface is running and accessible from the network.
• Exploit mechanism: An attacker attempts to access the WebAccess interface using common usernames and passwords, or by exploiting known vulnerabilities in the web application itself.
• Scope: Advantech WebAccess HMI solutions are affected. Specific versions were not provided.

3. Detection and Assessment

To confirm if a system is vulnerable, you can check for the presence of the WebAccess interface. A quick check involves looking for the service running on standard web ports.

• Quick checks: Use netstat -an | grep 80 or netstat -an | grep 443 to see if a process is listening on port 80 (HTTP) or 443 (HTTPS).
• Scanning: Nessus plugin ID 129675 can detect the Advantech WebAccess Web Administration Interface. This is an example only, and may require updating.
• Logs and evidence: Check web server logs for access attempts to paths commonly associated with WebAccess (e.g., /webaccess/).

netstat -an | grep 80

4. Solution / Remediation Steps

To fix this issue, you should restrict network access to the WebAccess interface or remove it if not required.

4.1 Preparation

• Ensure you have documented the current configuration for rollback purposes. A roll back plan is to restore from the snapshot.
• Changes should be made during a scheduled maintenance window with appropriate approvals.

4.2 Implementation

1. Step 1: Block external access to port 80 and 443 using a firewall.
2. Step 2: If the WebAccess interface is not required, uninstall it from the system.

4.3 Config or Code Example

Before

# Firewall rule allowing access from any source
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

After

# Firewall rule blocking access from all sources except trusted IPs
iptables -A INPUT -p tcp --dport 80 -s  -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue.

• Practice 1: Least privilege – restrict access to the WebAccess interface to only authorized users and systems.
• Practice 2: Network segmentation – isolate critical SCADA systems from untrusted networks.

4.5 Automation (Optional)

# Example Ansible playbook snippet for blocking port 80 with iptables
- name: Block access to WebAccess interface on port 80
  iptables:
    chain: INPUT
    protocol: tcp
    destination_port: 80
    jump: DROP
    state: present

5. Verification / Validation

Confirm the fix by verifying that external access to the WebAccess interface is blocked.

• Post-fix check: Run netstat -an | grep 80 and confirm no process is listening on port 80 from an untrusted network.
• Re-test: Attempt to access the WebAccess interface from a remote system; it should be unreachable.
• Monitoring: Monitor firewall logs for blocked connection attempts to port 80 and 443.

netstat -an | grep 80

6. Preventive Measures and Monitoring

Update security baselines and implement checks in deployment pipelines.

• Baselines: Update your network security baseline to include rules blocking unnecessary inbound traffic on ports like 80 and 443.
• Pipelines: Add a check in your CI/CD pipeline to ensure that the WebAccess interface is not exposed to untrusted networks during deployment.
• Asset and patch process: Implement a regular review of installed software and configurations to identify potentially vulnerable services like WebAccess.

7. Risks, Side Effects, and Roll Back

Blocking access to port 80 may impact other web applications running on the same system.

• Risk or side effect 1: Blocking port 80 could disrupt legitimate web services if not configured carefully. Mitigation: Ensure only necessary ports are blocked, and monitor for service disruptions.
• Roll back: Remove the firewall rule blocking access to port 80. Restore from snapshot if needed.

8. References and Resources

Link only to sources that match this exact vulnerability.

• Vendor advisory or bulletin: http://www.advantech.com/industrial-automation/webaccess