[FD] Security advisory: Pre-authentication RCE (default credentials + path traversal) in PulseNET Enterprise 6.0.3 (build 6975) (GE Vernova)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in PulseNET 
Enterprise 6.0.3 (build 6975) (GE Vernova). The research is published and a 
proof-of-concept is available.

Pre-authentication RCE (default credentials + path traversal) (CVSS 9.8, 
pre-authentication)

GE Vernova PulseNET Enterprise 6.0.3 is the network-management software 
electric utilities use to monitor and manage the industrial wireless networks 
connecting substations and distribution automation. It ships with 
factory-default admin/admin credentials with no forced password change, and the 
resource-management console builds the target file path by raw string 
concatenation with no normalization. Because Tomcat runs as root with 
autoDeploy enabled, an attacker can upload a JSP file into a new web 
application directory and execute arbitrary commands as root. Dynamically 
verified with uid=0(root).

Impact: Full compromise of the power-network management host as root. The 
attacker can read the host filesystem, execute arbitrary commands, and gain 
control of the system a utility relies on to manage communications with its 
grid.

Advisory: 
https://0day-rubbish.com/blog/ge-pulsenet-resource-file-path-traversal-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

Vendor has been notified. CVE ID is pending.

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/