CVE-2023-27856

What it actually does

CVE-2023-27856 is a path traversal vulnerability in Rockwell Automation ThinManager ThinServer. When ThinServer processes a network message of type 8, it fails to properly constrain the requested file path to an intended directory. An unauthenticated remote attacker with network access to the ThinServer service can request and download arbitrary files located on the same disk drive where ThinServer.exe is installed. The flaw primarily affects confidentiality: it does not require credentials, user interaction, or local access, and it can expose configuration files, application data, credentials stored on disk, logs, certificates, scripts, or other sensitive operational files accessible to the ThinServer process.

Why it matters to the business

Successful exploitation can expose sensitive industrial operations data and system configuration information from ThinManager servers. In an OT or industrial environment, leaked files may help attackers understand terminal-server architecture, credentials, network layout, automation dependencies, or operational procedures, enabling follow-on intrusion even though this vulnerability does not directly modify files or execute code. The issue has a high EPSS score and is reported as weaponized, so exposed ThinServer instances should be treated as high-priority remediation targets, especially where reachable from untrusted networks or shared enterprise/OT segments.

How an attack unfolds

An attacker first identifies a reachable Rockwell Automation ThinManager ThinServer service. Because exploitation is unauthenticated and low-complexity, the attacker does not need valid ThinManager credentials. The attacker then sends a specially crafted ThinServer protocol message of type 8 containing path traversal sequences or otherwise manipulated file paths. ThinServer incorrectly resolves the requested path outside the expected location and returns file contents from the disk drive where ThinServer.exe is installed. The attacker can repeat this process to collect configuration files, logs, application files, certificates, scripts, or other readable data. The downloaded information may then be used to plan additional attacks against the ThinManager deployment, Windows host, terminal services infrastructure, or broader industrial network.

How to fix it

Upgrade Rockwell Automation ThinManager to a vendor-supported version that contains the fix for CVE-2023-27856. If an exact fixed version is not already defined in asset records, use the current Rockwell Automation security advisory and ThinManager release notes to select the corrected maintenance release for the deployed major version. Where immediate upgrade is not possible, restrict network access to ThinServer to only required management and operational systems, block access from untrusted networks, place the service behind OT-aware firewalls or jump hosts, and enforce segmentation between enterprise, remote access, and control-system networks. Remove unnecessary files from the ThinServer installation drive, avoid storing credentials or sensitive exports on that drive, rotate any secrets that may have been exposed, and ensure the ThinServer process runs with the least privileges required.

How to confirm the fix worked

Confirm the installed ThinManager/ThinServer version is no longer in an affected release range according to Rockwell Automation guidance. Validate that network access to the ThinServer service is limited to explicitly authorized hosts and that unauthenticated access from general user, enterprise, VPN, internet-facing, or vendor-access networks is blocked. Perform a controlled security test from an authorized assessment host to verify that crafted type 8 requests cannot retrieve files outside the intended application directory. Review file-system permissions on the ThinServer installation drive and confirm sensitive files are not readable by the ThinServer service account unless required. After patching, monitor for failed traversal attempts and confirm no successful arbitrary file downloads are observed in logs, packet captures, or network telemetry.

Typical attack path

1. Discover an exposed or reachable Rockwell Automation ThinManager ThinServer service.
2. Confirm the service is ThinServer and accepts unauthenticated protocol messages.
3. Send a crafted message of type 8 containing path traversal or arbitrary file path content.
4. Download files from the disk drive where ThinServer.exe is installed.
5. Review retrieved files for credentials, configuration details, certificates, hostnames, network paths, user names, or operational data.
6. Use the exposed information for follow-on access, lateral movement, phishing, credential attacks, or targeted OT reconnaissance.

How to detect it

Investigate whether the ThinServer service received suspicious unauthenticated requests associated with message type 8, especially requests containing path traversal strings such as ../ or ..\, absolute Windows paths, or references to sensitive files. Useful sources include ThinManager and ThinServer application logs, Windows Event Logs, EDR telemetry, firewall logs, NetFlow, packet captures, IDS/IPS alerts, and reverse-proxy or remote-access logs if access is brokered. Look for inbound connections to ThinServer from unauthorized subnets, unusual source countries, VPN pools, scanning infrastructure, or hosts that do not normally administer ThinManager. If packet capture is available, inspect sessions for file-retrieval responses, repeated path probing, or requests for configuration, credential, certificate, log, database, or Windows system files. On the host, review access timestamps for sensitive files on the ThinServer.exe installation drive and correlate them with network connections to the ThinServer process. Because the vulnerability can disclose files without modifying them, absence of file changes does not rule out exploitation; prioritize network evidence, process telemetry, and anomalous file-read activity by ThinServer.exe.

• ThinServer.exe
• message type 8
• ../
• ..\
• %2e%2e%2f
• %2e%2e%5c
• C:\Windows\win.ini
• C:\Windows\System32\drivers\etc\hosts
• C:\Windows\System32\config\SAM
• C:\Windows\System32\config\SYSTEM
• C:\Program Files\Rockwell Automation\ThinManager
• C:\Program Files (x86)\Rockwell Automation\ThinManager
• ThinManager
• ThinServer

What your security team should do

• Prioritize remediation for any ThinManager ThinServer instance reachable from untrusted, enterprise, remote-access, or internet-adjacent networks because exploitation is unauthenticated, weaponized, and has a high EPSS score.
• Inventory all Rockwell Automation ThinManager deployments and record installed ThinManager/ThinServer versions, listening interfaces, and allowed management paths.
• Upgrade affected ThinManager installations to a Rockwell-supported fixed release as soon as operational change controls allow.
• Apply compensating controls immediately: firewall the ThinServer service, restrict access to known management hosts, and enforce segmentation between enterprise IT and OT networks.
• Search for evidence of prior arbitrary file retrieval, especially requests containing traversal patterns, absolute Windows paths, or unusual file downloads from ThinServer.
• Rotate passwords, API keys, certificates, and other secrets that may have been stored on or accessible from the ThinServer installation drive if exploitation is suspected.
• Increase monitoring around ThinManager servers for follow-on activity such as unusual logons, remote service creation, new scheduled tasks, credential dumping indicators, or unexpected outbound connections.