2f07358143
16 changes to exploits/shellcodes/ghdb InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS) Bludit 4.0.0-rc-2 - Account takeover Microsoft Windows 11 - 'cmd.exe' Denial of Service
88 lines
No EOL
3.8 KiB
Text
88 lines
No EOL
3.8 KiB
Text
## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset
|
|
## Exploit Author: LiquidWorm
|
|
|
|
Vendor: Sielco S.r.l
|
|
Product web page: https://www.sielco.org
|
|
Affected version: PolyEco1000 CPU:2.0.6 FPGA:10.19
|
|
PolyEco1000 CPU:1.9.4 FPGA:10.19
|
|
PolyEco1000 CPU:1.9.3 FPGA:10.19
|
|
PolyEco500 CPU:1.7.0 FPGA:10.16
|
|
PolyEco300 CPU:2.0.2 FPGA:10.19
|
|
PolyEco300 CPU:2.0.0 FPGA:10.19
|
|
|
|
Summary: PolyEco is the innovative family of high-end digital
|
|
FM transmitters of Sielco. They are especially suited as high
|
|
performance power system exciters or compact low-mid power
|
|
transmitters. The same cabinet may in fact be fitted with 50,
|
|
100, 300, 500, 1000W power stage (PolyEco50, 100, 300, 500,
|
|
1000).
|
|
|
|
All features can be controlled via the large touch-screen display
|
|
4.3" or remotely. Many advanced features are inside by default
|
|
in the basic version such as: stereo and RDS encoder, audio
|
|
change-over, remote-control via LAN and SNMP, "FFT" spectral
|
|
analysis of the audio sources, SFN synchronization and much more.
|
|
|
|
Desc: Improper access control occurs when the application provides
|
|
direct access to objects based on user-supplied input. As a result
|
|
of this vulnerability attackers can bypass authorization and access
|
|
resources behind protected pages.
|
|
|
|
Tested on: lwIP/2.1.1 (http://savannah.nongnu.org/projects/lwip)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
Macedonian Information Security Research and Development Laboratory
|
|
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2023-5768
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5768.php
|
|
|
|
|
|
26.01.2023
|
|
|
|
--
|
|
|
|
|
|
index.htm:
|
|
----------
|
|
54: function dologin() {
|
|
55: var hash = hex_md5($('#password').val() + id);
|
|
56: $.get('/login.cgi', {
|
|
57: user: $('#user').val(),
|
|
58: password: hash,
|
|
59: id: id
|
|
60: }).done(function (data) {
|
|
61: var dati = $.parseXML(data);
|
|
62: id = $(dati).find('id').text();
|
|
63: user = $(dati).find('u').text();
|
|
64: if (id == 0)
|
|
65: window.location.href = '/index.htm';
|
|
66: else {
|
|
67: scriviCookie('polyeco', id, 180);
|
|
68: if (user >= 3)
|
|
69: window.location.href = '/protect/factory.htm';
|
|
70: else
|
|
71: window.location.href = '/protect/index.htm';
|
|
72: }
|
|
73: });
|
|
74: }
|
|
|
|
|
|
The function 'dologin()' in index.htm is called when a user submits a login form.
|
|
It starts by calculating a hash of the user-entered password and a variable 'id'
|
|
using the hex_md5 function. Then it makes an HTTP GET request to the 'login.cgi'
|
|
endpoint with the user's entered username, the calculated password hash and the
|
|
'id' variable as parameters. If the request is successful, the function parses the
|
|
XML data returned from the server, extracting the values of the 'id' and 'u' elements.
|
|
Then it checks the value of the 'id' variable, if it's equal to 0 then it redirects
|
|
the user to '/index.htm', otherwise, it writes a cookie called 'polyeco' with the
|
|
value of 'id' and expires after 180 days.
|
|
|
|
After that it checks the value of the 'user' variable, if it's greater than or equal
|
|
to 3, it redirects the user to '/protect/factory.htm', otherwise it redirects the
|
|
user to '/protect/index.htm'. An attacker can exploit this by modifying the client-side
|
|
JavaScript to always set the 'user' variable to a high value (4), or by tampering with
|
|
the data sent to the server during the login process to change the value of the 'user'
|
|
variable. It also works if the server's response variable 'user' is modified. |