CVE-2023-26150: Improper Authentication in asyncua
Summary
CVE-2023-26150: Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. Affects asyncua across 3 version ranges.
< 0.9.96
< 2be7ce80df05de8d6c6ae1ebce6fa2bb7147844a
< b4106dfd5037423c9d1810b48a97296b59cde513
Fixed in b4106dfd5037423c9d1810b48a97296b59cde513. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
asyncua is a Python package available on PyPI that provides an asynchronous implementation of the OPC UA (Open Platform Communications Unified Architecture) protocol. OPC UA is a machine-to-machine communication protocol for industrial automation. asyncua allows developers to create OPC UA clients and servers using asyncio, a Python library for asynchronous programming. However, versions of asyncua before 0.9.96 are vulnerable to an Improper Authentication issue, which allows unauthorized access to the Address Space without encryption and authentication.
Vulnerability Detail
The Improper Authentication vulnerability in asyncua arises due to missing checks for services that require an active session. This means that an attacker can bypass the authentication and encryption mechanisms and gain unauthorized access to the Address Space. The Address Space contains information about the structure and organization of the OPC UA server, including data points, methods, and other resources. By accessing the Address Space without proper authentication, an attacker can potentially manipulate or extract sensitive information, disrupt operations, or perform unauthorized actions.
How To Fix
Minimum fixed version
b4106dfd5037423c9d1810b48a97296b59cde513
This is the first release that contains the fix.
pip install --upgrade "asyncua==b4106dfd5037423c9d1810b48a97296b59cde513"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of asyncua to address the issue.
Conclusion
The asyncua package prior to version 0.9.96 is vulnerable to Improper Authentication, allowing unauthorized access to the Address Space without encryption and authentication. To address this issue, it is crucial to upgrade to asyncua version 0.9.96 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for asyncua →
FAQ
asyncua is a Python package that provides an asynchronous implementation of the OPC UA protocol. It allows developers to create OPC UA clients and servers using asyncio.
The Address Space in OPC UA is a hierarchical structure that represents the structure and organization of an OPC UA server. It contains information about data points, methods, and other resources.
Improper Authentication refers to a vulnerability where authentication mechanisms are not properly enforced, allowing unauthorized access to protected resources or services.
The potential consequences of this vulnerability include unauthorized access to the Address Space, manipulation or extraction of sensitive information, disruption of operations, and unauthorized actions.
To mitigate the risk of this vulnerability, it is recommended to upgrade to asyncua version 0.9.96 or later, which includes the necessary checks for proper authentication and encryption.
References
Related vulnerabilities
Recent vulnerabilities recorded for asyncua.
