Execution of any zenon function in HTML5 Webclient by manipulating frontend JS code

Execution of any zenon function in HTML5 Webclient by manipulating frontend JS code

Summary

The security issue that resulted in arbitrary function execution from the WebEngine frontend to the backend is now fixed. Now only functions that are linked to available screen elements are possible to execute.

Description

The security issue that resulted in arbitrary function execution from the WebEngine frontend to the backend is now fixed. Now only functions that are linked to available screen elements are possible to execute.



Issue Number: 225691
Fixed on Date: 10.9.2020
Versions: 8.10 0 BUILD 68622 | 8.20 0 BUILD 68579
    • Related Articles

    • zenon Changesets CSV

      Here, you can access a comprehensive list of changes across all maintained versions of the zenon Software Platform as Excel Worksheets. This includes both implemented bug-fixes and new features. Additionally, these lists are available in as Excel ...
    • zenon Changesets Excel

      Here, you can access a comprehensive list of changes across all maintained versions of the zenon Software Platform as Excel Worksheets. This includes both implemented bug-fixes and new features. Additionally, these lists are available in CSV format ...
    • FAQ: Which IE version is used by the HTML screen? Which Plugins can be executed?

      The HTML-screen created in zenon does not use the default-browser installed on the operating system. It uses the pre-installed rendering-engine of Microsoft, called "Microsoft Web Browser Control". This program emulates the Internet Explorer. ...
    • "set value" function in HTML Web Engine

      Description When compiling a project for the HTML Web Engine, an error message is displayed for a set value function: "Variable not found." In the HTML Web Engine, the set value cannot be set via a button with this function. The button is not ...
    • zenon logic: Unexpected complex data in expression

      In zenon version 8.20, it was possible to initiate and assign the function block in one line. This was not IEC compliant, therefore feature was removed in zenon 10. Now the error message "Unexpected complex data in expression" is logged when using ...