Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability exists in a gas station automation system, allowing unauthenticated attackers to bypass security controls. This issue could enable unauthorized access to sensitive functions, including managing fuel dispensers, pricing, and payment terminals.
- Unauthenticated attackers can take administrative control.
- Essential for securing operational technology infrastructure.
- Confirm relevance and potential exposure of the system.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could reach the gas station automation system over the network and exploit a flaw in its login process. By sending a specific type of request to the `ajax-login.php` endpoint with arbitrary credentials, the attacker can trick the system into granting administrative privileges. Because subsequent administrative actions in the configuration module don't re-verify the user's session, the attacker can then remotely invoke any administrative command, potentially affecting critical functions like user management and pricing rules.
- Attacker can connect to the system.
- Improperly validated login credentials.
- Full administrative control of system.
Live Threat
Current exploitation, exposure, and threat context
The Nefteprodukttekhnika BUK TS-G Gas Station Automation System's configuration module could allow an unauthenticated remote attacker to gain administrative control. This could enable them to read or modify various operational settings, including user rules, fuel dispensing parameters, pricing, and financial transaction components.
- Administrative control over gas station operations.
- Exploiting an improper authentication flaw.
- Unauthorized changes to fuel prices and sales.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
The Nefteprodukttekhnika BUK TS-G Gas Station Automation System is the responsibility of the asset owner and the operational technology (OT) team managing the gas station's control systems. The first practical step is to identify all instances of this system, determine their network exposure and criticality, and then engage with the system owner to plan for remediation during a scheduled maintenance window, considering the potential for unauthorized administrative access.
- Identify system owners and asset locations.
- Verify network exposure and criticality.
- Plan remediation with vendor coordination.
