KevinLAB BEMS 1.0 Authenticated File Path Traversal Information Disclosure

Title: KevinLAB BEMS 1.0 Authenticated File Path Traversal Information Disclosure
Advisory ID: ZSL-2021-5656
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information
Risk: (3/5)
Release Date: 20.07.2021
Summary
KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS (Building Energy Management System) enables efficient energy management in buildings. It improves the efficient of energy use by collecting and analyzing various information of energy usage and facilities in the building. It also manages energy usage, facility efficiency and indoor environment control.
Description
The BEMS suffers from an authenticated arbitrary file disclosure vulnerability. Input passed through the 'page' GET parameter in index.php is not properly verified before being used to include files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
Vendor
KevinLAB Inc. - http://www.kevinlab.com
Affected Version
4ST L-BEMS 1.0.0 (Building Energy Management System)
Tested On
Linux CentOS 7
Apache 2.4.6
Python 2.7.5
PHP 5.4.16
MariaDB 5.5.68
Vendor Status
[05.07.2021] Vulnerability discovered.
[08.07.2021] Vendor contacted.
[12.07.2021] No response from the vendor.
[13.07.2021] Vendor contacted.
[19.07.2021] No response from the vendor.
[20.07.2021] Public security advisory released.
PoC
kevinlab_bems_lfi.txt
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] https://packetstormsecurity.com/files/163573/
[2] https://www.exploit-db.com/exploits/50147
[3] https://cxsecurity.com/issue/WLB-2021070123
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/205981
Changelog
[20.07.2021] - Initial release
[21.07.2021] - Added reference [1], [2] and [3]
[22.07.2021] - Added reference [4]
Contact
Zero Science Lab

Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk