Details of VAR-201708-1398

ID

VAR-201708-1398

CVE

CVE-2017-9640

TITLE

ALC WebCTRL i-Vu/SiteScan Web Path traversal vulnerability

Trust: 0.8

sources: IVD: f06fbadd-bae1-46a3-8a6f-c5a536b9697e // CNVD: CNVD-2017-22829

DESCRIPTION

A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to overwrite files that are used to execute code. This vulnerability does not affect version 6.5 of the software. ALC WebCTRL , i-Vu ,and SiteScan Web Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ALC WebCTRL is a building automation platform. Multiple Automated Logic Corporation Products are prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability. An attacker can exploit these issues to obtain sensitive information, to upload arbitrary code, and run it in the context of the webserver process. WebCTRL®, Automated Logic's web-based building automationsystem, is known for its intuitive user interface and powerful integrationcapabilities. It allows building operators to optimize and manageall of their building systems - including HVAC, lighting, fire, elevators,and security - all within a single HVAC controls platform. It's everythingthey need to keep occupants comfortable, manage energy conservation measures,identify key operational problems, and validate the results.WebCTRL suffers from an authenticated arbitrary code execution vulnerability. The issue is caused due to the improper verification when uploading Add-on (.addons or .war) files using the uploadwarfile servlet. This can be exploited to execute arbitrary code by uploading a malicious web archive file that will run automatically and can be accessed from within the webroot directory. Additionaly, an improper authorization access control occurs when using the 'anonymous' user. By specification, the anonymous user should not have permissions or authorization to upload or install add-ons. The anonymous user was removed from version 6.5 of WebCTRL.Tested on: Microsoft Windows 7 Professional (6.1.7601 Service Pack 1 Build 7601)Apache-Coyote/1.1Apache Tomcat/7.0.42CJServer/1.1Java/1.7.0_25-b17Java HotSpot Server VM 23.25-b01Ant 1.7.0Axis 1.4Trove 2.0.2Xalan Java 2.4.1Xerces-J 2.6.1. The vulnerability exist due to the improper permissions,with the 'M' flag (Modify) or 'C' flag (Change) for 'Authenticated Users' group.The application suffers from an unquoted search path issue as well impacting the service'WebCTRL Service' for Windows deployed as part of WebCTRL server solution. This couldpotentially allow an authorized but non-privileged local user to execute arbitrarycode with elevated privileges on the system. A successful attempt would require thelocal user to be able to insert their code in the system root path undetected by theOS or other security applications where it could potentially be executed duringapplication startup or reboot. If successful, the local user’s code would executewith the elevated privileges of the application.Tested on: Microsoft Windows 7 Professional SP1 (EN). Desc: The vulnerability is triggered by an authenticated user that can use the manualcommand console in the management panel of the affected application. The ManualCommand() function in ManualCommand.js allows users to perform additional diagnostics and settings overview by using pre-defined set of commands. This can be exploited by using the echo command to write and/or overwrite arbitrary files on the system including directory traversal throughout the system

Trust: 2.97

sources: NVD: CVE-2017-9640 // JVNDB: JVNDB-2017-007643 // CNVD: CNVD-2017-22829 // BID: 100452 // IVD: f06fbadd-bae1-46a3-8a6f-c5a536b9697e // ZSL: ZSL-2017-5431 // ZSL: ZSL-2017-5430 // ZSL: ZSL-2017-5429 // PACKETSTORM: 143896

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: f06fbadd-bae1-46a3-8a6f-c5a536b9697e // CNVD: CNVD-2017-22829

AFFECTED PRODUCTS

vendor:	automatedlogic	model:	sitescan web	scope:	lte	version:	6.1	Trust: 1.0
vendor:	carrier	model:	automatedlogic webctrl	scope:	lte	version:	6.1	Trust: 1.0
vendor:	automatedlogic	model:	i-vu	scope:	lte	version:	5.5	Trust: 1.0
vendor:	automatedlogic	model:	sitescan web	scope:	lte	version:	5.2	Trust: 1.0
vendor:	carrier	model:	automatedlogic webctrl	scope:	lte	version:	5.2	Trust: 1.0
vendor:	automatedlogic	model:	i-vu	scope:	lte	version:	5.2	Trust: 1.0
vendor:	carrier	model:	automatedlogic webctrl	scope:	lte	version:	6.0	Trust: 1.0
vendor:	automatedlogic	model:	sitescan web	scope:	lte	version:	5.5	Trust: 1.0
vendor:	carrier	model:	automatedlogic webctrl	scope:	lte	version:	5.5	Trust: 1.0
vendor:	automatedlogic	model:	i-vu	scope:	lte	version:	6.0	Trust: 1.0
vendor:	webctrl	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	automated logic	model:	i-vu	scope:	lte	version:	5.2	Trust: 0.8
vendor:	automated logic	model:	i-vu	scope:	lte	version:	5.5	Trust: 0.8
vendor:	automated logic	model:	i-vu	scope:	lte	version:	6.0	Trust: 0.8
vendor:	automated logic	model:	i-vu	scope:	lte	version:	6.5	Trust: 0.8
vendor:	automated logic	model:	sitescan web	scope:	lte	version:	5.2	Trust: 0.8
vendor:	automated logic	model:	sitescan web	scope:	lte	version:	5.5	Trust: 0.8
vendor:	automated logic	model:	sitescan web	scope:	lte	version:	6.1	Trust: 0.8
vendor:	automated logic	model:	sitescan web	scope:	lte	version:	6.5	Trust: 0.8
vendor:	automated logic	model:	webctrl	scope:	lte	version:	5.2	Trust: 0.8
vendor:	automated logic	model:	webctrl	scope:	lte	version:	5.5	Trust: 0.8
vendor:	automated logic	model:	webctrl	scope:	lte	version:	6.0	Trust: 0.8
vendor:	automated logic	model:	webctrl	scope:	lte	version:	6.1	Trust: 0.8
vendor:	automated logic	model:	webctrl	scope:	lte	version:	6.5	Trust: 0.8
vendor:	i vu	model:	-	scope:	eq	version:	*	Trust: 0.6
vendor:	sitescan web	model:	-	scope:	eq	version:	*	Trust: 0.6
vendor:	ibm automated logic	model:	sitescan web	scope:	lte	version:	<=6.5	Trust: 0.6
vendor:	automated logic	model:	alc webctrl i-vu	scope:	lte	version:	<=6.0	Trust: 0.6
vendor:	automated logic	model:	alc webctrl sitescan web	scope:	lte	version:	<=6.1	Trust: 0.6
vendor:	automated logic	model:	sitescan web i-vu alc webctrl	scope:	lte	version:	<=6.5	Trust: 0.6
vendor:	automated logic	model:	sitescan web i-vu alc webctrl	scope:	lte	version:	<=5.5	Trust: 0.6
vendor:	automated logic	model:	sitescan web i-vu alc webctrl	scope:	lte	version:	<=5.2	Trust: 0.6
vendor:	automatedlogic	model:	i-vu	scope:	eq	version:	6.0	Trust: 0.6
vendor:	automatedlogic	model:	sitescan web	scope:	eq	version:	5.5	Trust: 0.6
vendor:	automatedlogic	model:	sitescan web	scope:	eq	version:	5.2	Trust: 0.6
vendor:	automatedlogic	model:	webctrl	scope:	eq	version:	6.1	Trust: 0.6
vendor:	automatedlogic	model:	webctrl	scope:	eq	version:	5.5	Trust: 0.6
vendor:	automatedlogic	model:	webctrl	scope:	eq	version:	5.2	Trust: 0.6
vendor:	automatedlogic	model:	sitescan web	scope:	eq	version:	6.1	Trust: 0.6
vendor:	automatedlogic	model:	i-vu	scope:	eq	version:	5.2	Trust: 0.6
vendor:	automatedlogic	model:	i-vu	scope:	eq	version:	5.5	Trust: 0.6
vendor:	automatedlogic	model:	webctrl	scope:	eq	version:	6.0	Trust: 0.6
vendor:	automated logic	model:	webctrl	scope:	lte	version:	sitescan web 6.1 and prior	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	lte	version:	i-vu 6.0 and prior	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	lte	version:	sitescan web 5.5 and prior	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	lte	version:	sitescan web 5.2 and prior	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	eq	version:	6.1 and 6.0	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	eq	version:	6.5	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	eq	version:	6.1	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	eq	version:	6.0	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	eq	version:	5.5	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	eq	version:	5.2	Trust: 0.3
vendor:	automated logic	model:	sitescan web	scope:	eq	version:	6.5	Trust: 0.3
vendor:	automated logic	model:	sitescan web	scope:	eq	version:	6.1	Trust: 0.3
vendor:	automated logic	model:	sitescan web	scope:	eq	version:	5.5	Trust: 0.3
vendor:	automated logic	model:	sitescan web	scope:	eq	version:	5.2	Trust: 0.3
vendor:	automated logic	model:	i-vu	scope:	eq	version:	6.5	Trust: 0.3
vendor:	automated logic	model:	i-vu	scope:	eq	version:	6.0	Trust: 0.3
vendor:	automated logic	model:	i-vu	scope:	eq	version:	5.5	Trust: 0.3
vendor:	automated logic	model:	i-vu	scope:	eq	version:	5.2	Trust: 0.3
vendor:	automated logic	model:	webctrl	scope:	lte	version:	sitescan web 6.5 and prior	Trust: 0.2

sources: ZSL: ZSL-2017-5431 // ZSL: ZSL-2017-5430 // ZSL: ZSL-2017-5429 // IVD: f06fbadd-bae1-46a3-8a6f-c5a536b9697e // CNVD: CNVD-2017-22829 // BID: 100452 // JVNDB: JVNDB-2017-007643 // CNNVD: CNNVD-201706-863 // NVD: CVE-2017-9640

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-9640
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-9640
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2017-22829
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201706-863
value:	MEDIUM
Trust: 0.6
IVD:	f06fbadd-bae1-46a3-8a6f-c5a536b9697e
value:	MEDIUM
Trust: 0.2
ZSL:	ZSL-2017-5431
value:	(4/5)
Trust: 0.1
ZSL:	ZSL-2017-5430
value:	(3/5)
Trust: 0.1
ZSL:	ZSL-2017-5429
value:	(3/5)
Trust: 0.1

nvd@nist.gov:	CVE-2017-9640
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-22829
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	f06fbadd-bae1-46a3-8a6f-c5a536b9697e
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2017-9640
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.0
Trust: 1.8

sources: ZSL: ZSL-2017-5431 // ZSL: ZSL-2017-5430 // ZSL: ZSL-2017-5429 // IVD: f06fbadd-bae1-46a3-8a6f-c5a536b9697e // CNVD: CNVD-2017-22829 // JVNDB: JVNDB-2017-007643 // CNNVD: CNNVD-201706-863 // NVD: CVE-2017-9640

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.8

sources: JVNDB: JVNDB-2017-007643 // NVD: CVE-2017-9640

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201706-863

TYPE

Path traversal

Trust: 0.8

sources: IVD: f06fbadd-bae1-46a3-8a6f-c5a536b9697e // CNNVD: CNNVD-201706-863

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-007643

EXPLOIT AVAILABILITY

sources: ZSL: ZSL-2017-5431 // ZSL: ZSL-2017-5430 // ZSL: ZSL-2017-5429

PATCH

title:	Security Best Practices Checklists for Building Automation Systems (BAS)	url:	http://www.automatedlogic.com/Pages/Security.aspx	Trust: 0.8
title:	ALC WebCTRL i-Vu/SiteScan Web Path Traversal Vulnerability Patch	url:	https://www.cnvd.org.cn/patchInfo/show/100836	Trust: 0.6
title:	ALC WebCTRL , i-Vu and SiteScan Web Repair measures for path traversal vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99872	Trust: 0.6

sources: CNVD: CNVD-2017-22829 // JVNDB: JVNDB-2017-007643 // CNNVD: CNNVD-201706-863

EXTERNAL IDS

db:	NVD	id:	CVE-2017-9640	Trust: 3.7
db:	ICS CERT	id:	ICSA-17-234-01	Trust: 3.0
db:	BID	id:	100452	Trust: 2.1
db:	EXPLOIT-DB	id:	42543	Trust: 1.7
db:	CNVD	id:	CNVD-2017-22829	Trust: 0.8
db:	CNNVD	id:	CNNVD-201706-863	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-007643	Trust: 0.8
db:	PACKETSTORM	id:	143896	Trust: 0.2
db:	ZSL	id:	ZSL-2017-5430	Trust: 0.2
db:	IVD	id:	F06FBADD-BAE1-46A3-8A6F-C5A536B9697E	Trust: 0.2
db:	PACKETSTORM	id:	143897	Trust: 0.1
db:	EXPLOIT-DB	id:	42544	Trust: 0.1
db:	NVD	id:	CVE-2017-9650	Trust: 0.1
db:	CXSECURITY	id:	WLB-2017080166	Trust: 0.1
db:	ZSL	id:	ZSL-2017-5431	Trust: 0.1
db:	AUSCERT	id:	ESB-2017.2113	Trust: 0.1
db:	CXSECURITY	id:	WLB-2017080165	Trust: 0.1
db:	CXSECURITY	id:	WLB-2017080167	Trust: 0.1
db:	NVD	id:	CVE-2017-9644	Trust: 0.1
db:	BID	id:	100454	Trust: 0.1
db:	EXPLOIT-DB	id:	42542	Trust: 0.1
db:	PACKETSTORM	id:	143895	Trust: 0.1
db:	ZSL	id:	ZSL-2017-5429	Trust: 0.1

sources: ZSL: ZSL-2017-5431 // ZSL: ZSL-2017-5430 // ZSL: ZSL-2017-5429 // IVD: f06fbadd-bae1-46a3-8a6f-c5a536b9697e // CNVD: CNVD-2017-22829 // BID: 100452 // JVNDB: JVNDB-2017-007643 // PACKETSTORM: 143896 // CNNVD: CNNVD-201706-863 // NVD: CVE-2017-9640

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-17-234-01	Trust: 3.0
url:	http://www.securityfocus.com/bid/100452	Trust: 1.8
url:	https://www.exploit-db.com/exploits/42543/	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2017-9640	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9640	Trust: 1.0
url:	http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9640	Trust: 0.6
url:	http://www.automatedlogic.com	Trust: 0.4
url:	http://www.automatedlogic.com/pages/security_commitment.aspx	Trust: 0.3
url:	http://www.automatedlogic.com/specsheets/security_best_practices_checklists_for_building_automation_systems_(bas)pdf.pdf	Trust: 0.3
url:	http://www.securityweek.com/automated-logic-patches-flaws-building-automation-system	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2017-9650	Trust: 0.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9650	Trust: 0.1
url:	https://www.exploit-db.com/exploits/42544/	Trust: 0.1
url:	https://packetstormsecurity.com/files/143897	Trust: 0.1
url:	https://cxsecurity.com/issue/wlb-2017080166	Trust: 0.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/130767	Trust: 0.1
url:	http://www.vfocus.net/art/20170824/13802.html	Trust: 0.1
url:	https://cxsecurity.com/issue/wlb-2017080165	Trust: 0.1
url:	https://packetstormsecurity.com/files/143896	Trust: 0.1
url:	https://www.auscert.org.au/bulletins/51482	Trust: 0.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/130766	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-9644	Trust: 0.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9644	Trust: 0.1
url:	https://packetstormsecurity.com/files/143895	Trust: 0.1
url:	https://cxsecurity.com/issue/wlb-2017080167	Trust: 0.1
url:	https://www.exploit-db.com/exploits/42542/	Trust: 0.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/130760	Trust: 0.1
url:	http://www.securityfocus.com/bid/100454	Trust: 0.1
url:	http://target/touch.txt	Trust: 0.1
url:	https://www.zeroscience.mk/en/vulnerabilities/zsl-2017-5430.php	Trust: 0.1

sources: ZSL: ZSL-2017-5431 // ZSL: ZSL-2017-5430 // ZSL: ZSL-2017-5429 // CNVD: CNVD-2017-22829 // BID: 100452 // JVNDB: JVNDB-2017-007643 // PACKETSTORM: 143896 // CNNVD: CNNVD-201706-863 // NVD: CVE-2017-9640

CREDITS

Vulnerability discovered by Gjoko Krstic

Trust: 0.3

sources: ZSL: ZSL-2017-5431 // ZSL: ZSL-2017-5430 // ZSL: ZSL-2017-5429

SOURCES

db:	ZSL	id:	ZSL-2017-5431
db:	ZSL	id:	ZSL-2017-5430
db:	ZSL	id:	ZSL-2017-5429
db:	IVD	id:	f06fbadd-bae1-46a3-8a6f-c5a536b9697e
db:	CNVD	id:	CNVD-2017-22829
db:	BID	id:	100452
db:	JVNDB	id:	JVNDB-2017-007643
db:	PACKETSTORM	id:	143896
db:	CNNVD	id:	CNNVD-201706-863
db:	NVD	id:	CVE-2017-9640

LAST UPDATE DATE

2025-04-20T23:04:20.569000+00:00

SOURCES UPDATE DATE

db:	ZSL	id:	ZSL-2017-5431	date:	2017-08-28T00:00:00
db:	ZSL	id:	ZSL-2017-5430	date:	2017-08-25T00:00:00
db:	ZSL	id:	ZSL-2017-5429	date:	2017-08-25T00:00:00
db:	CNVD	id:	CNVD-2017-22829	date:	2017-08-25T00:00:00
db:	BID	id:	100452	date:	2017-08-22T00:00:00
db:	JVNDB	id:	JVNDB-2017-007643	date:	2017-09-27T00:00:00
db:	CNNVD	id:	CNNVD-201706-863	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-9640	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	ZSL	id:	ZSL-2017-5431	date:	2017-08-22T00:00:00
db:	ZSL	id:	ZSL-2017-5430	date:	2017-08-22T00:00:00
db:	ZSL	id:	ZSL-2017-5429	date:	2017-08-22T00:00:00
db:	IVD	id:	f06fbadd-bae1-46a3-8a6f-c5a536b9697e	date:	2017-08-25T00:00:00
db:	CNVD	id:	CNVD-2017-22829	date:	2017-08-25T00:00:00
db:	BID	id:	100452	date:	2017-08-22T00:00:00
db:	JVNDB	id:	JVNDB-2017-007643	date:	2017-09-27T00:00:00
db:	PACKETSTORM	id:	143896	date:	2017-08-23T07:06:24
db:	CNNVD	id:	CNNVD-201706-863	date:	2017-06-21T00:00:00
db:	NVD	id:	CVE-2017-9640	date:	2017-08-25T19:29:00.410