Swascan Offensive Security Team detected some important potential vulnerabilities on:
- Dixell XWEB-500
Detected vulnerabilities were:
|Arbitrary File Write||http://<target>/cgi-bin/logo_extra_upload.cgi|
In the following section we are reporting some technical details on these vulnerabilities including evidences and proof-of-concepts.
CWE-73: External Control of File Name or Path
Emerson Dixell XWEB-500 products are vulnerable to Arbitrary File Write attack. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to filesystem space bursting and, as so a Denial of Service.
The next images represent the evidence of the vulnerability and how it was possible to write any files into the filesystem using the CGIs listed in the previous sections:
CWE-548: Exposure of Information Through Directory Listing
CVSSv3: 5.3 [AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N]
Emerson Dixell XWEB-500 products are affected by Information Disclosure via Directory Listing. A potential attacker can use this misconfiguration to access all the files present in the directories.
In this particular case, we found that the java directory was very interesting because contains many .jar files that have been used to find hidden cgi. Furthermore, this can allow finding other exploitation vectors using reverse engineering techniques.
The next images represent the evidence of the vulnerability and how it was possible to list the files:
Below is a sample of the reverse engineering process to find some hidden cgi:
Out of an abundance of caution, this CVE ID is being assigned to better serve customers and ensure all who are still running this product understands that the product has not been supported since 2018 and should be removed or replaced with XWEB PRO. Further information on supported Dixell products can be found at https://webapps.emerson.com/Dixell/Pages/Leaflets or by contacting customer support at [email protected].