Executive brief
Scada-LTS is a SCADA (industrial control system) monitoring and management platform. The application disables CSRF protection on all web endpoints, allowing an attacker to trick a logged-in operator into unknowingly creating, modifying, or deleting critical system configurations (watch lists, reports, settings) by visiting a malicious webpage. This undermines audit trails and can lead to unauthorized changes to industrial processes.
Technical details
Scada-LTS disables Spring Security's CSRF protection across all HTTP contexts by setting `<csrf disabled="true"/>` in spring-security.xml. Authenticated endpoints such as /api/watch-lists and /api/reports/save accept POST/PUT/DELETE requests with no CSRF token validation, relying solely on session cookies (JSESSIONID) for authentication. An attacker can craft a malicious webpage that submits hidden forms to these endpoints; when a logged-in victim visits the page, their browser automatically includes their session cookie, executing the unauthorized request. No alternative CSRF mitigations (double-submit tokens, SameSite enforcement, per-request nonces) are present in the codebase. The vulnerability affects all versions up to and including the develop branch commit 1cfaed4b35117e4871bc3dfeae073f61d8e3bb3d, and the vendor has not yet released a patch.
Affected products
- SCADA-LTS Scada-LTS up to 2.7.8.1
Timeline
- 2025-11-30: disclosed
- other: publicly available exploit published on GitHub