CVE-2021-44477: GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference

Q: What is CVE-2021-44477?

CVE-2021-44477 is an XML external entity (XXE) vulnerability in GE Gas Power ToolBoxST Version v04.07.05C.

Q: How does CVE-2021-44477 affect GE Gas Power ToolBoxST?

CVE-2021-44477 allows for disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack.

Q: What is the severity of CVE-2021-44477?

CVE-2021-44477 has a severity rating of 7.5 (High).

Q: How can I fix CVE-2021-44477?

To fix CVE-2021-44477, update GE Gas Power ToolBoxST to version 07.09.07c or higher.

Q: Where can I find more information about CVE-2021-44477?

More information about CVE-2021-44477 can be found at https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01.

Published Mar 25, 2022

Updated

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.

Affected Software

2 affected componentsFixes available

GE Gas Power ToolBoxST OSC<07.09.07

07.09.07

GE ToolBoxST<07.09.07c

Remediation

Information

GE addressed CVE-2021-44477 in ToolBoxST OS Version 07.09.07C and above by disabling the use of DTD’s, which are not necessary for ToolBoxST functionality. GE upgraded the Ionic library in ToolBoxST Version 7.8.0 to resolve CVE-2018-16202 Users should ensure they follow the password protection and network segmentation guidance laid out in GEH-6839 Secure Deployment Guide. Additionally, the use of SDI Secure Mode offers considerable protection against this attack as the threat actor must be able to perform a download to the controller over SDI. Secure Mode validates authenticity and protects against spoofing of SDI commands.

Event History

Mar 25, 2022

CVE Published

via MITRE·06:02 PM

Data Sourced

via MITRE·06:02 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-025-01

Frequently Asked Questions

What is CVE-2021-44477?

CVE-2021-44477 is an XML external entity (XXE) vulnerability in GE Gas Power ToolBoxST Version v04.07.05C.

How does CVE-2021-44477 affect GE Gas Power ToolBoxST?

CVE-2021-44477 allows for disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack.

What is the severity of CVE-2021-44477?