Using Extensions
Install and use only trusted extensions
Target group: End users, system administrators
Description: In CODESYS 4, extensions are not run in a security sandbox. They are only isolated from each other while being loaded. An installed extension has full permissions of the product and of the executing user, and is therefore part of the trusted base of the system – just like the product core itself.
Action: Install exclusively verified and approved extensions from trusted sources.
Reasoning: A malicious or compromised extension can perform any action the executing user is authorized to perform – including accessing any data and projects that the user is authorized to access.
Do not bypass signature verification during package installation
Target group: End users, system administrators
Description: By default, the package manager c4-pkm checks the signature of each package during installation. The CLI options --unsafe-allow-unsigned-packages, --unsafe-allow-expired-packages, and --unsafe-skip-signature-verification bypass this check. When they are used, a warning is issued and explicit acknowledgement is required. You can use the c4-pkm verify [--strict] command to check signatures, unpacked contents, and the package cache afterwards. This will also flag any insecurely installed or expired packages.
Action: Only use the --unsafe-* option in justified exceptions. When in doubt, use c4-pkm verify to check installations afterwards.
Reasoning: Signature verification makes sure that packages are unchanged and undamaged during installation. If it is bypassed, then manipulated or malicious packages can be installed unnoticed. See also: Install and use only trusted extensions.