Johnson Controls C•CURE 9000 directory permissions flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Incorrect default permissions in C•CURE 9000 Site Server allow local privilege escalation to steal application credentials.
Johnson Controls Software House C•CURE 9000 Site Server versions 2.80 and prior contain insufficient protection of directories containing executables (CWE-276). Under certain circumstances, the application provides insufficient file permissions on the CouchDB\bin directory, allowing an attacker with local access and user-level privileges to escalate permissions and access sensitive credentials used for application authentication. The vulnerability affects deployments with the optional C•CURE IQ Web and/or C•CURE Portal components installed. This product controls building automation systems across critical infrastructure sectors including manufacturing, energy, transportation, and government facilities worldwide. CISA reports no known public exploitation of this vulnerability at this time. Mitigation requires removing Full Control and Write permissions from the affected directory and restricting non-administrator accounts to Read & Execute only.
Mentioned in this report
Detection guidance
Executable or Script Written to CouchDB bin Directory by Non-Installer Process
Detects creation of executables, DLLs or scripts in a CouchDB\bin directory by a process other than a known installer. This is the primitive used to abuse weak directory permissions for privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable or Script Written to CouchDB bin Directory by Non-Installer Process
description: Detects creation or replacement of executable content (exe, dll, bat,
cmd, ps1, vbs) inside a CouchDB\bin directory by a process that is not an installer.
Insufficient permissions on this directory (CWE-276, C-CURE 9000) let a low-privileged
local user plant or replace binaries that are later run with higher privileges.
Generalises on the directory and file type, not on specific file names.
tags:
- attack.privilege-escalation
- attack.t1548.002
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: \CouchDB\bin\
TargetFilename|endswith:
- .exe
- .dll
- .bat
- .cmd
- .ps1
- .vbs
filter_installers:
Image|endswith:
- \msiexec.exe
- \TrustedInstaller.exe
- \TiWorker.exe
condition: selection and not filter_installers
falsepositives:
- Administrators manually upgrading or patching CouchDB or C-CURE components outside
an MSI installer
- Software deployment agents that copy CouchDB files directly
level: medium
id: f4e92a06-3c8d-550e-87b6-1b0c48b10ec9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-05
Shell or Script Interpreter Spawned from CouchDB Process
Detects a command shell or scripting host launched by a process running from a CouchDB directory, which suggests a replaced or hijacked binary executing with elevated rights. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell or Script Interpreter Spawned from CouchDB Process
description: Detects cmd, PowerShell, wscript, cscript, mshta or similar interpreters
spawned by a parent running from a CouchDB install directory. After abusing weak
permissions on CouchDB\bin, an attacker's planted binary typically launches a shell
in the context of the service account.
tags:
- attack.privilege-escalation
- attack.t1548.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: \CouchDB\
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
condition: selection
falsepositives:
- Administrator-written CouchDB maintenance or startup batch wrappers that invoke
cmd.exe
level: high
id: 7b9ec761-3134-5428-b69c-0c3fc41b863f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-05
Permission Change on CouchDB bin Directory via icacls or Similar Tools
Detects icacls, cacls, takeown or xcacls targeting a CouchDB\bin directory, which could indicate permission tampering or an attempt to take ownership of the directory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Permission Change on CouchDB bin Directory via icacls or Similar Tools
description: Detects permission or ownership modification tools targeting a CouchDB\bin
path. Legitimate hardening removes Write and Full Control for non-admins, whereas
granting rights or taking ownership of this directory enables privilege escalation.
tags:
- attack.privilege-escalation
- attack.t1548.002
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- \icacls.exe
- \cacls.exe
- \xcacls.exe
- \takeown.exe
selection_target:
CommandLine|contains: \CouchDB\bin
selection_grant:
CommandLine|contains:
- /grant
- /setowner
- /f
condition: selection_tool and selection_target and selection_grant
falsepositives:
- Administrators applying the vendor hardening guidance with icacls, which may use
/grant or /inheritance switches
- Installation scripts that set ACLs on the CouchDB directory
level: medium
id: 9cda9f59-64e9-5e1b-a2c7-ac24759bd2f8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-05
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-05
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs