EasyIO 30P: CVE-2018-15820 (Stored XSS) and CVE-2018-15819 (Authentication bypass)

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="12"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#13">By Date</a>
<a href="14"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="12"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#13">By Thread</a>
<a href="15"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>

</div>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">EasyIO 30P: CVE-2018-15820 (Stored XSS) and CVE-2018-15819 (Authentication bypass)</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->


<em>From</em>: Daniel dos Santos &lt;daniel.dossantos () forescout com&gt;


<em>Date</em>: Sun, 7 Apr 2019 13:22:07 +0000


<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;">INFORMATION

Product: EasyIO 30P (<a rel="nofollow" href="http://www.easyio.com">http://www.easyio.com</a>)
Affected versions: &lt; 2.0.5.27 (tested on version 2.0.5.16)
CVE IDs: CVE-2018-15820 (Stored XSS) and CVE-2018-15819 (Authentication bypass)
Remote-exploit: yes

TIMELINE

Vendor notification: 3rd August, 2018
Vendor acknowledgment: 22nd August, 2018
Patch available: 8th October, 2018
Public disclosure: 7th April, 2019

INTRODUCTION

The EasyIO-30P controllers are rugged, network centric, multi-protocols Input
/ Output controllers to accommodate general and specific applications, featuring
Bacnet IP, Bacnet Ethernet, Bacnet MSTP, Modbus Serial (RS485) and Modbus TCP/IP
protocols. It also has a built-in web server for easy configuration.
(Description from: <a rel="nofollow" href="https://www.easyio.eu/products/bms-controllers/easyio-30p-bms-controller/">https://www.easyio.eu/products/bms-controllers/easyio-30p-bms-controller/</a>)

The two vulnerabilities described below affect the web application that runs in
the controllers and that is used to manage them.

VULNERABILITIES DESCRIPTION

The XSS vulnerability (CVE-2018-15820) allows an attacker to inject malicious
scripts into the trusted web interface running on a vulnerable device. The
scripts may be executed by the browser of an unsuspecting device administrator
to access session tokens or other sensitive information, as well as to perform
malicious actions on behalf of the user (e.g., internal network discovery and
traffic tunneling using BeEF).

Stored XSS PoC (show alert dialog):
POST http://&lt;device_address&gt;/EASYIO30P-&lt;session_token&gt;/dev.htm
GDN=...'onMouseOver='alert(1);&amp;GDG=Group&amp;GDL=Location

The authentication bypass vulnerability (CVE-2018-15819) allows an attacker to
execute privileged requests in the vulnerable application without possessing
valid credentials, by manipulating the session token sent in a request. Any
string of the same size as a valid token is accepted. The attacker can use this
vulnerability to steal the credential information of application users,
including plaintext passwords (see the proof-of-concept below).

Authentication bypass PoC (access the file containing plaintext passwords):
http://&lt;device_address&gt;/EASYIO30P-123456789012345678901234567890123456789012345678/webuser.js

SOLUTION

Update to version 2.0.5.27
WARNING - CONFIDENTIAL INFORMATION:
________________________________
The information contained in the e-mail may contain confidential and privileged information and is intended solely for 
the use of the intended recipient(s). Access for any review, re-transmission, dissemination or other use of, or taking 
of any action in regard and reliance upon this e-mail by persons or entities other than the intended recipient(s) is 
unauthorized and prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and 
destroy all copies of the original message and any attachments.

_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives &amp; RSS: <a rel="nofollow" href="http://seclists.org/fulldisclosure/">http://seclists.org/fulldisclosure/</a>

</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="12"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#13">By Date</a>
<a href="14"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="12"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#13">By Thread</a>
<a href="15"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><strong>EasyIO 30P: CVE-2018-15820 (Stored XSS) and CVE-2018-15819 (Authentication bypass)</strong> <em>Daniel dos Santos (Apr 09)</em>
</li></ul>


<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>