Title: OpenBMCS 2.4 Unauthenticated SSRF / RFI
Advisory ID: ZSL-2022-5694
Type: Local/Remote
Impact: Exposure of System Information, Cross-Site Scripting
Risk: (4/5)
Release Date: 16.01.2022

Summary

Building Management & Controls System (BMCS). No matter what the size of your business, the OpenBMCS software has the ability to expand to hundreds of controllers. Our product can control and monitor anything from a garage door to a complete campus wide network, with everything you need on board.

Description

Unauthenticated Server-Side Request Forgery (SSRF) and Remote File Include (RFI) vulnerability exists in OpenBMCS within its functionalities. The application parses user supplied data in the POST parameter 'ip' to query a server IP on port 81 by default. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host. This can be used by an external attacker for example to bypass firewalls and initiate a service and network enumeration on the internal network through the affected application, allows hijacking the current session of the user, execute cross-site scripting code or changing the look of the page and content modification on current display.

Vendor

OPEN BMCS - https://www.openbmcs.com

Affected Version

2.4

Tested On

Linux Ubuntu 5.4.0-65-generic (x86_64)
Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)
Apache/2.4.41 (Ubuntu)
Apache/2.4.25 (Debian)
nginx/1.16.1
PHP/7.4.3
PHP/7.0.33-0+deb9u9

Vendor Status

[26.10.2021] Vulnerability discovered.
[17.11.2021] Vendor contacted.
[15.01.2022] No response from the vendor.
[16.01.2022] Public security advisory released.

PoC

openbmcs_ssrf_rfi.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] https://www.exploit-db.com/exploits/50670
[2] https://packetstormsecurity.com/files/165585
[3] https://exchange.xforce.ibmcloud.com/vulnerabilities/217382
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/217381

Changelog

[16.01.2022] - Initial release
[20.01.2022] - Added reference [1], [2], [3] and [4]

Contact

Zero Science Lab

Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk