Critical Vulnerabilities in Hitachi Energy MSM: Risks and Mitigations

In the ever-evolving landscape of cybersecurity, flaws in critical infrastructure can pose significant risks to the integrity, confidentiality, and availability of services. A recent advisory from the Cybersecurity and Infrastructure Security Agency (CISA) highlighted two critical vulnerabilities affecting Hitachi Energy's Monitoring and Control System, MSM (Management System Monitoring), which could potentially expose these systems to remote exploitation. Let’s delve deeply into the impacts of these vulnerabilities and what users should know to protect their networks.

Executive Summary of the Vulnerability​

Recent findings show that Hitachi Energy’s MSM software, specifically versions 2.2.8 and earlier, is vulnerable to two noteworthy security issues. With a CVSS v3 score of 8.6, indicating high severity, the vulnerabilities are categorized as remotely exploitable with low attack complexity. The vulnerabilities identified include:

• Missing Release of Resource after Effective Lifetime (CVE-2024-2398)
• Loop with Unreachable Exit Condition (Infinite Loop) (CVE-2019-5097)

These findings should raise red flags for organizations that rely on MSM for their monitoring operations.

Risk Evaluation​

Exploitation of these vulnerabilities could allow malicious actors to compromise the confidentiality, integrity, or availability of the MSM. This means unauthorized users could gain access, manipulate data, or even bring down essential systems, posing serious risks, particularly in the energy sector where MSM is deployed worldwide.

Breaking Down the Technical Details​

1. Affected Products​

The vulnerabilities specifically impact the Hitachi Energy MSM software, underscoring the need for users to evaluate their current version and take corrective actions if they are running a compromised version.

2. Vulnerability Overview​

A. Missing Release of Resource after Effective Lifetime (CWE-772)​

This vulnerability arises when the HTTP/2 server push mechanism fails to properly release memory after sending excess headers. When libcurl (a popular library for transferring data with URLs) receives more headers than allowed, it aborts the push but fails to deallocate memory. The consequence? A memory leak that can lead to performance issues or crashes, all while being undetectable by the application.

• Impact: Increased memory consumption can degrade service, creating opportunities for Denial of Service (DoS) attacks.
• Mitigation: Users are urged to apply patches as they become available to address this flaw efficiently.

B. Loop with Unreachable Exit Condition (CWE-835)​

This exploitable flaw permits malformed HTTP/POST requests to create an infinite loop, leading to a Denial of Service vulnerability. This situation can arise in scenarios where attackers craft requests to exploit the GoAhead web server processes on the affected MSM versions.

• Impact: An attacker can disrupt services by making the application unresponsive due to the infinite processing loop.
• Mitigation: Similar to the previous vulnerability, applying the necessary updates as outlined by Hitachi is critical.

Recommended Mitigations​

Hitachi Energy has laid out comprehensive recommendations for mitigating the risks associated with these vulnerabilities:

1. Immediate Updates: Users should promptly apply updates once available.
2. Network Isolation: MSM should not be connected directly to the Internet. Network isolation minimizes risks from outside attacks.
3. Access Management: Implement user access controls and robust antivirus solutions on computers running the MSM Client application.
4. Follow Hardening Guidelines: Adhere to practices outlined by the Center for Internet Security (CIS) to enhance the security posture of systems that interface with MSM.

Best Practices to Follow:​

• Physically Secure Systems: Limit physical access to critical systems.
• Firewall Protections: Use firewalls to limit open ports and monitor traffic between your process control systems and the outside world.
• Scan External Devices: Ensure all portable computers and removable media are scanned for malware before connecting them to critical systems.

For more detailed mitigation strategies, refer to the CIS recommendations available online.

Conclusion: The Importance of Proactive Cybersecurity​

With these vulnerabilities, organizations are reminded of the critical nature of maintaining their systems and staying vigilant against potential threats. No known exploitation targeting these specific vulnerabilities has been reported; however, the absence of known attacks doesn’t equate to safety.
Effectively managing these vulnerabilities is essential for the security and resilience of infrastructure. As we often say in tech, "an ounce of prevention is worth a pound of cure." Keep your software up to date, follow best practices, and ensure your defenses are robust, especially in sectors as vital as energy.
If you have any thoughts or experiences dealing with similar vulnerabilities, feel free to share and discuss them on the forum!

---

Source: CISA Hitachi Energy MSM