Description

A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T08:16:38.987Z",
  "pubdate": "2026-09-21T08:16:38.987Z",
  "executiveSummary": "ScadaBR versions up to 1.1 contain an unauthenticated information disclosure vulnerability located within the Export Project Endpoint.\nThe vulnerability resides in the EmportDwr.createExportJSON function, which fails to enforce necessary access control policies.\nSuccessful exploitation allows a remote, unauthenticated attacker to extract sensitive project data without authorization.\nWhile the import functionality was previously protected by the Permissions.ensureAdmin() method, the export function was omitted, creating an insecure object reference or missing function-level access control scenario.\nThe risk is critical, as ScadaBR is often used in industrial control systems, and unauthorized access to project configurations can lead to further reconnaissance or system compromise.\nRemediation requires upgrading the affected component to version 1.2.0 or applying the specific patch identifier c852b4988a15bce6011ef169299ad604538f70a9.",
  "technicalDetails": "The vulnerability is classified as an authorization bypass resulting in sensitive information disclosure within the ScadaBR application. The flaw exists within the /ScadaBR/export_project.htm component, specifically targeting the EmportDwr.createExportJSON method.\nRoot Cause: The root cause of this vulnerability is improper access control implementation. In the ScadaBR framework, administrative actions are expected to be gated by the Permissions.ensureAdmin() function. While the development team correctly applied this security control to the import functionality, they failed to implement the same authentication and authorization checks on the export function. Consequently, the createExportJSON method remains publicly accessible.\nAttack Flow: A remote attacker can trigger the vulnerability by sending a specifically crafted request to the /ScadaBR/export_project.htm endpoint. Because the function lacks session validation or permission verification, the server executes the export operation regardless of the requester's authentication state. The application subsequently processes the request and serializes sensitive project configuration data into a JSON format, which is then returned to the attacker in the HTTP response body.\nExploitation Method: An attacker does not require valid credentials to invoke this function. The request can be initiated via standard browser requests or automated tools (e.g., cURL or Burp Suite) targeting the exposed endpoint. Upon execution, the system retrieves internal project settings and exports them as a downloadable file or stream, revealing information that should be restricted to administrative users.\nImpact: The post-exploitation impact is severe. Information disclosure of project exports typically includes sensitive data such as device communication parameters, tag configurations, polling intervals, and potential network topography details. In an Industrial Control System (ICS) environment, this exposure assists adversaries in performing detailed reconnaissance, allowing them to map the system architecture and prepare for follow-on attacks, such as man-in-the-middle interceptions, denial-of-service, or the manipulation of industrial processes based on revealed logic configurations.\nScope and Exposure: The vulnerability is remotely exploitable without prerequisites, significantly increasing the attack surface for ScadaBR installations that are exposed to network environments, including those improperly segmented from the public internet or corporate LANs."
}