Schneider Electric U.motion Builder up to 1.3.3 Directory Tree editscript.php path traversal

Summaryinfo

A vulnerability was found in Schneider Electric U.motion Builder up to 1.3.3. It has been classified as critical. This affects an unknown function of the file editscript.php of the component Directory Tree. The manipulation leads to path traversal. This vulnerability is listed as CVE-2018-7771. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Schneider Electric U.motion Builder up to 1.3.3 (Automation Software). It has been rated as critical. This issue affects an unknown code block of the file editscript.php of the component Directory Tree. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity, and availability. The summary by CVE is:

The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree.

The bug was discovered 04/19/2018. The weakness was presented 07/03/2018 (Website). The advisory is shared at schneider-electric.com. The identification of this vulnerability is CVE-2018-7771 since 03/08/2018. The attack may be initiated remotely. The requirement for exploitation is a simple authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 75 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:editscript.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.3.4 eliminates this vulnerability.

See VDB-120298, VDB-120285, VDB-120286 and VDB-120287 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Automation Software

Vendor

• Schneider Electric

Name

• U.motion Builder

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3

License

• commercial

Website

• Vendor: https://www.schneider-electric.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion