Vulnerability Details
The following vulnerability exists in OPC Spider. An attacker with access to the product may decrypt credentials encrypted with a hard-coded encryption key if they obtain the ScriptRunner or ScriptRunner for Amazon SQS launch configuration files.
| CVE ID | CVSS v3.1 Base Score | Description | References |
|---|---|---|---|
| CVE-2023-28937 | 8.8 (High) | Use of a hard-coded encryption key in ScriptRunner launch configuration files | NVD |
Affected Products
| Product | Affected Versions |
|---|---|
| OPC Spider | Ver. 1.2.1 and earlier |
Fixed Versions
| Product | Fixed Version |
|---|---|
| OPC Spider | Ver. 1.2.2 |
Steps Required After Updating
After applying the fixed version, the already encrypted credentials must be re-encrypted.
If you use ScriptRunner
After updating, re-encrypt all launch settings files using the following steps.
- Open a launch settings file, and replace the value for the password element with a plain text password.
- Specify [false] for the encrypt attribute of the password element, or delete the attribute.
- Encrypt the password described in step 1 by following the "Password encryption of launch settings file" section in the "ScriptRunner" help page.
To use the launch settings file in another environment, you must perform the above procedure again.
If you use ScriptRunner for Amazon SQS
After updating, re-encrypt all launch settings files and property files using the following steps.
- Open a launch settings file, and replace the values for the secretkey element and password element with a plain text secret key and password.
- Specify [false] for the encrypt attributes of the secretkey element and password element, or delete the attributes.
- Encrypt the secret key and password described in step 1 by following the "Secret key and password encryption of launch settings file" section in the "ScriptRunner for Amazon SQS" help page.
- Open a property file, and replace the value for the AWS_SECRET_KEY key with a plain text secret key.
- Specify [false] for the ENCRYPTED key, or delete the ENCRYPTED key.
- Encrypt the secret key described in step 4 by following the "Secret key encryption of property file" section in the "ScriptRunner for Amazon SQS" help page.
To use the launch settings file and the property file in another environment, you must perform the above procedure again.
Contact
fa-support@takebishi.co.jp
Revision History
- 2023-05-01: Initial release