Sharang ParnerkarandClaude Opus 4.8
5e8250f7e9
CI / Check (pull_request) Failing after 4m3s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
Adds the first dynamic dimension to PLC/SPS targets: probe the running device over industrial protocols, complementing the static control-logic rules. - New ScanType::IcsProbe (+ phase), offered for PlcSps with a reachable endpoint (opt-in / default-off). - pipeline::ics::modbus — a minimal, read-only Modbus/TCP client: issues Read Holding Registers + Read Device Identification, never writes to the live process. Detects an endpoint that answers unauthenticated Modbus and reads its device identity (vendor/product/revision). - pipeline::ics::probe_target — emits findings: `ics-modbus-exposed` (Critical, CWE-306 — Modbus/TCP has no auth/encryption by protocol design) and `ics-device-disclosure` (Low, CWE-200). Targets the Modbus port (502) of the target's Live URL, independent of any WebVisu HTTP port. - orchestrator: a PLC/SPS target runs the ICS probe when planned (alongside the control-logic scan and DAST). Unit-tested against an in-process mock Modbus server + endpoint-parsing and device-id parsing tests. Docs: new "Dynamic testing — ICS protocol probe" section. First increment of #148 (soft-PLC + industrial-protocol probing); OPC UA / EtherNet-IP and the OpenPLC soft-PLC harness (orca-infra) follow. Tracker #167. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
98 lines
4.5 KiB
Markdown
98 lines
4.5 KiB
Markdown
# PLC / SPS Projects (CODESYS)
|
|
|
|
Certifai analyzes industrial control logic (IEC 61131-3) for PLC/SPS targets such
|
|
as CODESYS projects. A single PLC/SPS target is treated as a **composite device**:
|
|
the control application *and* the device it runs on.
|
|
|
|
| What you provide | What Certifai does |
|
|
| --- | --- |
|
|
| PLC project (PLCopen XML / ST, or a `.projectarchive`) | **Control-logic SAST** — semantic security rules over ST **and** graphical FBD/LD |
|
|
| A `.projectarchive` | **Control-app SBOM** — the referenced CODESYS libraries + the runtime version, matched against known CVEs |
|
|
| A device firmware image | Firmware SBOM / CVE (opt-in) |
|
|
| A reachable endpoint (WebVisu, OPC UA) | DAST / pentest (opt-in) |
|
|
|
|
## Two ways to deliver the project
|
|
|
|
You can either **upload** the project when onboarding, or point Certifai at a
|
|
**git repository** (recommended — every scan is just a `git pull`, no re-upload).
|
|
|
|
### Option A — Upload
|
|
|
|
On the onboarding wizard, choose target type **PLC / SPS**, then attach a **PLC
|
|
project** artifact and pick its format:
|
|
|
|
- **PLCopen XML** (`.xml`) — export from CODESYS via *Project → Export PLCopenXML*.
|
|
- **Structured Text** (`.st`) — a raw ST file.
|
|
- **Project archive** (`.projectarchive`) — *File → Project Archive → Save/Send
|
|
Archive…* with **"Referenced libraries"** ticked. This is the only form that
|
|
also yields the **library + runtime SBOM**.
|
|
|
|
### Option B — Git repository (recommended)
|
|
|
|
Attach a **Git repository** artifact to the PLC/SPS target. Certifai clones it and
|
|
runs the control-logic scan over the exported source in the repo.
|
|
|
|
## Best-case git repository layout
|
|
|
|
Because the binary `.project` does not diff or merge in git, commit **textual
|
|
exports** for review-friendly SAST, and include the **`.projectarchive`** so the
|
|
library/runtime SBOM is available too:
|
|
|
|
```text
|
|
my-plc-project/
|
|
├── src/
|
|
│ ├── PLC_PRG.xml # PLCopen XML export (ST or FBD/LD) — one per POU
|
|
│ ├── PumpController.xml
|
|
│ ├── SafetyInterlock.xml
|
|
│ └── GVL.xml # global variable lists, also as PLCopen XML
|
|
├── PumpStation.projectarchive # optional but recommended → library + runtime SBOM
|
|
└── README.md
|
|
```
|
|
|
|
**Guidelines**
|
|
|
|
- **Export to PLCopen XML** (`Project → Export PLCopenXML`), one file per POU, and
|
|
commit those. ST, **and graphical FBD/LD**, are both analyzed.
|
|
- Alternatively commit raw `.st` / `.exp` / `.scl` files — also analyzed.
|
|
- **Do not** commit only the binary `.project` — it cannot be parsed (and does not
|
|
diff). If you want the library SBOM, commit the **`.projectarchive`** as well.
|
|
- CODESYS's built-in Git integration, which stores an exported representation,
|
|
works too — as long as the committed form is PLCopen XML / textual.
|
|
|
|
::: tip What unlocks what
|
|
- **Control-logic SAST** needs textual source in the repo (PLCopen XML or `.st`).
|
|
- **Library + runtime SBOM** needs a **`.projectarchive`** — PLCopen XML exports do
|
|
**not** carry the referenced libraries.
|
|
:::
|
|
|
|
## What the scanner finds
|
|
|
|
The control-logic rules are CWE-mapped and include: hardcoded credentials
|
|
(CWE-798), default/weak passwords (CWE-1393), safety interlock / watchdog bypass
|
|
(CWE-1384), unchecked array indexing (CWE-129), division-by-zero (CWE-369,
|
|
guard-aware), cleartext/insecure communication (CWE-319), insecure protocol ports
|
|
(CWE-319, e.g. Modbus 502, FTP 21, Telnet 23), and unstructured jumps (CWE-691).
|
|
|
|
The **SBOM** view lists the CODESYS libraries (`pkg:codesys/<name>@<version>`) and
|
|
the runtime; matching runtime components (e.g. the `Cmp*` / `3SLicense` libraries)
|
|
surface real CODESYS advisories as CVE alerts.
|
|
|
|
## Dynamic testing — ICS protocol probe
|
|
|
|
Beyond the static analysis, Certifai can **probe the running device** over
|
|
industrial protocols. Attach a **Live URL** artifact (the device host / WebVisu
|
|
URL) to the PLC/SPS target and enable the **ICS Probe** scan.
|
|
|
|
The probe is **read-only** — it never writes to the live process. It currently
|
|
speaks **Modbus/TCP** (port 502): it confirms whether the device answers
|
|
unauthenticated Modbus requests and reads its device identity (vendor / product /
|
|
revision). Because Modbus/TCP has no authentication or encryption in the protocol,
|
|
a reachable endpoint that answers is reported as an exposed control interface
|
|
(CWE-306). OPC UA and EtherNet/IP probes are planned.
|
|
|
|
::: warning
|
|
The ICS probe connects to the live device. It is **opt-in** (off by default) and
|
|
should only be run against targets you are authorized to test. It performs reads
|
|
only, never writes.
|
|
:::
|