CVE-2023-34994: 
Open Automation Software vulnerability analysis and mitigation

An improper resource allocation vulnerability (CVE-2023-34994) was discovered in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. The vulnerability was disclosed on September 5, 2023, and affects the configuration management functionality of the platform. This vulnerability allows authenticated users to create arbitrary directories through specially crafted network requests (Talos Advisory).

The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). It has a CVSS v3.1 base score of 3.1 (LOW) according to Talos, with a vector string of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. The vulnerability exists in the OAS Configuration tool, where authenticated application users can create new directories using a Create_Directory protobuf structure as part of an authenticated request. The protobuf structure contains fields for Version, UEP, ExistingDirectory, and NewDirectory (Talos Advisory).

The vulnerability allows an application user who is not authorized on the underlying system to create new directories anywhere that the underlying OAS user system account has access. This capability exists despite the user only having authentication within the OAS Engine and not on the underlying system (Talos Advisory).

The vulnerability can be triggered by sending a sequence of specially crafted network requests to the system. While authentication is required to exploit this vulnerability, the attack can be executed remotely with low privileges (Talos Advisory).

The vendor has released version v19 as a fix for this vulnerability. As additional mitigation measures, it is recommended to restrict access to the OAS Engine configuration server and its traffic to only those hosts authorized for configuration. Furthermore, it is advised to restrict read/write access for the OAS user to only locations that can safely be exposed to anyone on the network (Talos Advisory).