Unauthenticated WebSocket Access in SteVe v3.7.1 Allows Remote Command Execution via Crafted OCPP Requests

CVE-2024-44843.md

Unauthenticated WebSocket Access in SteVe v3.7.1 Enables Remote Command Execution

Summary

A critical vulnerability in the SteVe (v3.7.1) Open Charge Point Central System allows unauthenticated remote attackers to establish a WebSocket connection and issue arbitrary OCPP (Open Charge Point Protocol) requests. This flaw permits attackers to execute commands without authentication, leading to unauthorized access and manipulation of EV charging operations.

References

1. GitHub Issue #1546 ( steve-community/steve#1546 )

2. Vulnerable Code (OcppWebSocketHandshakeHandler.java) ( https://github.com/steve-community/steve/blob/master/src/main/java/de/rwth/idsg/steve/ocpp/ws/OcppWebSocketHandshakeHandler.java )

---

Affected Product

• Product: SteVe
• Vendor: steve-community
• Version: 3.7.1
• Component: OcppWebSocketHandshakeHandler.java

---

Vulnerability Type

• Type: Incorrect Access Control (CWE-284)
• Attack Type: Remote
• Authentication Required: No
• Privilege Escalation: Yes

---

Attack Vector

An attacker can interact with the WebSocket endpoint without authentication by knowing or guessing a valid Connector ID.

Steps to Reproduce:

1. Identify Connector ID
   The attacker determines a valid CONNECTOR_ID through guessing, leakage, or reconnaissance.

2. Establish WebSocket Connection

   wss://<STEVE_HOST>:<PORT>/steve/websocket/CentralSystemService/{CONNECTOR_ID}
   

3.Send Arbitrary OCPP Command

Example payload to initiate a transaction

2,"1","StartTransaction", { "connectorId": 1234225, "idTag": "test", "meterStart": 20, "timestamp": "2023-09-03T12:34:56Z" }]

4.Effect

The request is accepted and reflected in the SteVe dashboard as if it were legitimate, bypassing the expected OCPP security flow.

Impact

1. Unauthorized remote control over charging stations
2. Lack of authentication allows for impersonation and abuse
3. Operational disruption and data integrity risks