ABB Cylon Aspect 3.08.02 (aspectMemory.php) Arbitrary Heap Memory Configuration

🗓️ 13 Dec 2024 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 318 Views

ABB Cylon Aspect 3.08.02 has a vulnerability in aspectMemory.php allowing heap memory manipulation.

Reporter	Title	Published	Views	Family All 22
0day.today	ABB Cylon Aspect 3.08.02 bbmdUpdate.php Remote Code Execution Vulnerability	9 Jan 202500:00	–	zdt
Circl	CVE-2024-51544	5 Dec 202413:22	–	circl
Circl	CVE-2024-51550	5 Dec 202415:21	–	circl
CNNVD	ABB ASPECT 安全漏洞	5 Dec 202400:00	–	cnnvd
CNNVD	ABB ASPECT 安全漏洞	5 Dec 202400:00	–	cnnvd
CVE	CVE-2024-51544	5 Dec 202412:48	–	cve
CVE	CVE-2024-51550	5 Dec 202412:56	–	cve
Cvelist	CVE-2024-51544 Service Control	5 Dec 202412:48	–	cvelist
Cvelist	CVE-2024-51550 Data Validation / Sanitization	5 Dec 202412:56	–	cvelist
Exploit DB	ABB Cylon Aspect 3.08.02 (bbmdUpdate.php) - Remote Code Execution	15 Apr 202500:00	–	exploitdb

<html><body><p>ABB Cylon Aspect 3.08.02 (aspectMemory.php) Arbitrary Heap Memory Configuration


Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
                  Firmware: &lt;=3.08.02

Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.

Desc: An authenticated access vulnerability in the aspectMemory.php script
of ABB Cylon Aspect BMS/BAS controllers allows attackers to set arbitrary
values for Java heap memory parameters (HEAPMIN and HEAPMAX). This configuration
is written to /usr/local/aam/etc/javamem. The absence of input validation
can lead to system performance degradation, Denial-of-Service (DoS) conditions,
and crashes of critical Java applications.

Tested on: GNU/Linux 3.15.10 (armv7l)
           GNU/Linux 3.10.0 (x86_64)
           GNU/Linux 2.6.32 (x86_64)
           Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
           Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
           PHP/7.3.11
           PHP/5.6.30
           PHP/5.4.16
           PHP/4.4.8
           PHP/5.3.3
           AspectFT Automation Application Server
           lighttpd/1.4.32
           lighttpd/1.4.18
           Apache/2.2.15 (CentOS)
           OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
           OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2024-5883
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5883.php
CVE ID: CVE-2024-51544
        CVE-2024-51550
CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-51544
         https://www.cve.org/CVERecord?id=CVE-2024-51550


21.04.2024

--


$ cat project

                 P   R   O   J   E   C   T

                        .|
                        | |
                        |'|            ._____
                ___    |  |            |.   |' .---"|
        _    .-'   '-. |  |     .--'|  ||   | _|    |
     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
     |' | |.    |    ||       | |   |  |    ||      |
 ____|  '-'     '    ""       '-'   '-.'    '`      |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
         ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
         ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░ 


$ curl http://192.168.73.31/aspectMemory.php \
&gt; -H "Cookie: PHPSESSID=xxx"
&gt; -d "HEAPMIN=32M&amp;HEAPMAX=64M&amp;ACTION=COMMIT"

Heap Sizes Updated - restart Aspect to enable updated sizes
</p></body></html>

13 Dec 2024 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 3.19.8 - 10

CVSS 49.3

EPSS0.04748

SSVC