ABB Cylon Aspect 3.07.02 - File Disclosure

ABB Cylon Aspect 3.07.02 — Authenticated Arbitrary File Disclosure (Directory Traversal)

This article analyzes the authenticated arbitrary file disclosure vulnerability affecting ABB Cylon ASPECT firmware versions up to 3.07.02 (NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio). It explains the root cause, security impact, detection and remediation guidance, secure coding corrections, and operational hardening recommendations for building management systems (BMS).

Key facts

Vendor	ABB Ltd.
Product	ABB Cylon — ASPECT (NEXUS, MATRIX-2, ASPECT-Enterprise, ASPECT-Studio)
Affected firmware	≤ 3.07.02
Vulnerability	Authenticated arbitrary file disclosure via downloadDb.php 'file' parameter (directory traversal)
Advisory	ZSL-2024-5831 (discovered by Gjoko 'LiquidWorm' Krstic / zeroscience)
Date	21.04.2024

Summary of the issue

The ASPECT web application exposes a script (downloadDb.php) that accepts a 'file' GET parameter and returns file contents. Input was not validated or constrained to a safe directory, which makes the application vulnerable to directory traversal. An authenticated user can request files outside of the intended database path, potentially disclosing system files, configuration, credentials or other sensitive data stored on the host.

Why this is dangerous

• Disclosure of configuration files (for example storing credentials or keys) can lead to credential theft and lateral movement.
• System files (such as /etc/passwd, SSH keys, or application logs) can reveal user accounts, running services and attack vectors.
• In an OT/ICS context, leaks of system or configuration data can enable targeted sabotage of building controls or privileged takeover.

Technical analysis

Typical vulnerable pattern (illustrative)

<?php
// vulnerable snippet (illustrative only)
$baseDir = '/opt/aspect/databases/';
$file = $_GET['file'];              // no validation
$path = $baseDir . $file;
if (file_exists($path)) {
    header('Content-Type: application/octet-stream');
    readfile($path);
}
?>

Explanation: This simplified snippet concatenates an attacker-controlled query parameter to a base directory and serves the file. Without validating or canonicalizing the path, sequences like "../" (directory traversal) allow access to files outside the intended directory.

Secure coding fix — canonicalization + whitelist

<?php
// safer approach: canonicalize and enforce an allow-list root
$baseDir = '/opt/aspect/databases/';

// get raw user input
$requested = isset($_GET['file']) ? $_GET['file'] : '';

// sanitize: remove NULL bytes and control characters
$requested = preg_replace('/[\\0-\\x1F]/', '', $requested);

// build an absolute path and canonicalize
$fullPath = realpath($baseDir . DIRECTORY_SEPARATOR . $requested);

// ensure realpath succeeded and file is inside $baseDir
if ($fullPath === false || strpos($fullPath, realpath($baseDir)) !== 0) {
    http_response_code(400);
    echo 'Invalid file request';
    exit;
}

// further restrict acceptable files if possible (extension, name list)
$allowedExt = ['db', 'sqlite', 'bak'];
$ext = strtolower(pathinfo($fullPath, PATHINFO_EXTENSION));
if (!in_array($ext, $allowedExt, true)) {
    http_response_code(403);
    echo 'Not allowed';
    exit;
}

// safe to serve
header('Content-Type: application/octet-stream');
readfile($fullPath);
?>

Explanation: This corrected code canonicalizes the combined path with realpath(), then verifies the resolved path is within the intended base directory. It also enforces a whitelist of allowed extensions and strips control characters. These measures prevent directory traversal and reduce the chance of exposing unintended files.

Detection and monitoring

Log-based hunting

• Search web server logs for requests to downloadDb.php and any query parameters containing ../ or URL-encoded equivalents (%2e%2e, %252e%252e): e.g., look for "downloadDb.php?file=" entries.
• Alert on repeated 200 responses to file download endpoints from authenticated accounts that don't normally perform downloads.
• Monitor for requests that return content types or patterns that do not match expected database files (for example, responses containing typical system file headers or textual content).

Example Suricata/Snort-style detection snippet (defensive)

# Example Suricata/IDS rule to flag suspicious traversal attempts to downloadDb.php
alert http any any -> $HOME_NET any (msg:"WEB-ATTACK Directory Traversal attempt to downloadDb.php"; flow:established,to_server; http.uri; pcre:"/downloadDb\.php\?file=.*(\.\.\/|%2e%2e|%252e%252e)/i"; sid:1000001; rev:1;)

Explanation: This sample IDS rule flags HTTP requests to downloadDb.php where the file parameter contains typical traversal sequences (raw or URL-encoded). Tune and test rules carefully to minimize false positives in production environments.

Mitigation and remediation

• Apply vendor patches: check ABB support channels for firmware or application updates that address the issue and apply them as soon as possible.
• If a patch is not available, restrict access to the management interface — place the device behind a firewall, VPN, or management network accessible only to authorized staff.
• Disable or remove unused endpoints or scripts (for example, restrict or remove downloadDb.php) until a secure update is installed.
• Harden authentication: enforce strong credentials, multi-factor authentication for remote access, rotate default passwords, and audit active sessions.
• Implement network segmentation: isolate BMS/OT networks from corporate and Internet-facing networks, and use strict ACLs to limit which hosts can access management interfaces.
• Implement integrity and confidentiality controls for sensitive files (least privilege for file permissions, encryption for stored secrets where feasible).

Incident response checklist (if you suspect exploitation)

• Collect relevant logs (web server access logs, application logs, authentication events) and snapshot affected hosts for forensic analysis.
• Identify the account(s) used to access the endpoint; disable compromised credentials and require rotation.
• Search for unusual outbound connections or data exfiltration patterns from the BMS network.
• Apply patches or temporary mitigations (network blocking, endpoint hardening) and coordinate with vendor support for root-cause remediation.
• After containment, review and strengthen access controls, monitoring, and alerting to reduce recurrence risk.

Operational recommendations for building management systems

• Adopt defense-in-depth: combine network segmentation, host hardening, robust authentication and continuous monitoring.
• Restrict direct Internet access to BMS components; require remote maintenance via jump hosts or VPNs with strict logging.
• Perform periodic security assessments and code reviews of web-facing components that handle file operations.
• Keep inventories of firmware/software versions across deployed devices and maintain a patch management process for OT/ICS assets.

References and attribution

This vulnerability was publicly disclosed in Advisory ZSL-2024-5831 on 21.04.2024 and credited to Gjoko 'LiquidWorm' Krstic (@zeroscience). Affected product families include NEXUS, MATRIX-2, ASPECT-Enterprise and ASPECT-Studio running firmware up to 3.07.02.