b165516b1b
26 changes to exploits/shellcodes/ghdb ABB Cylon Aspect 3.08.02 - PHP Session Fixation ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery ABB Cylon FLXeon 9.3.4 - Default Credentials ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated) ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE) ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning Netman 204 - Remote command without authentication qBittorrent 5.0.1 - MITM RCE CMU CERT/CC VINCE 2.0.6 - Stored XSS CyberPanel 2.3.6 - Remote Code Execution (RCE) GeoVision GV-ASManager 6.1.0.0 - Broken Access Control GeoVision GV-ASManager 6.1.1.0 - CSRF MagnusSolution magnusbilling 7.3.0 - Command Injection Nagios Log Server 2024R1.3.1 - API Key Exposure WebFileSys 2.31.0 - Directory Path Traversal flatCore 1.5 - Cross Site Request Forgery (CSRF) GetSimpleCMS 3.3.16 - Remote Code Execution (RCE) Gnuboard5 5.3.2.8 - SQL Injection LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection MiniCMS 1.1 - Cross Site Scripting (XSS) NEWS-BUZZ News Management System 1.0 - SQL Injection phpIPAM 1.6 - Reflected Cross Site Scripting (XSS) RosarioSIS 7.6 - SQL Injection Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
50 lines
No EOL
2.4 KiB
Text
50 lines
No EOL
2.4 KiB
Text
# Exploit title: ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery
|
||
# Vendor: ABB Ltd.
|
||
# Product web page: https://www.global.abb
|
||
# Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
|
||
CBX Series (FLX Series)
|
||
CBT Series
|
||
CBV Series
|
||
Firmware: <=9.3.4
|
||
|
||
Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
|
||
series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
|
||
building management solutions. ABB BACnet controllers are designed for intelligent
|
||
control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
|
||
heat pump systems, air handling units (constant volume, variable air volume, and
|
||
multi-zone), rooftop units, electrical systems such as lighting control, variable
|
||
frequency drives and metering.
|
||
|
||
The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
|
||
connectivity and open integration for your building automation systems. It's scalable,
|
||
and modular, allowing you to control a diverse range of HVAC functions.
|
||
|
||
Desc: A CSRF vulnerability has been identified in the ABB Cylon FLXeon series. However,
|
||
exploitation is limited to specific conditions due to the server's CORS configuration
|
||
(Access-Control-Allow-Origin: * without Access-Control-Allow-Credentials: true). The
|
||
vulnerability can only be exploited under the following scenarios:
|
||
Same Domain: The attacker must host the malicious page on the same domain as the
|
||
target server.
|
||
Man-in-the-Middle (MitM): The attacker can intercept and modify traffic between
|
||
the user and the server (e.g., on an unsecured network).
|
||
Local Area Network (LAN) Access: The attacker must have access to the same network
|
||
as the target server.
|
||
Subdomains: The attacker can host the malicious page on a subdomain if the server
|
||
allows it.
|
||
Misconfigured CORS: The server’s CORS policy is misconfigured to allow certain
|
||
origins or headers.
|
||
Reflected XSS: The attacker can exploit a reflected XSS vulnerability to execute
|
||
JavaScript in the context of the target origin.
|
||
|
||
Tested on: Linux Kernel 5.4.27
|
||
Linux Kernel 4.15.13
|
||
NodeJS/8.4.0
|
||
Express
|
||
|
||
|
||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||
@zeroscience
|
||
|
||
|
||
Advisory ID: ZSL-2025-5918
|
||
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5918.php |