Security advisory: Pre-authentication RCE (default credentials + path traversal) in PulseNET Enterprise 6.0.3 (build 6975) (GE Vernova)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in PulseNET Enterprise 6.0.3 (build 6975) (GE 
Vernova). The research is published and a proof-of-concept is available.

Pre-authentication RCE (default credentials + path traversal) (CVSS 9.8, pre-authentication)

GE Vernova PulseNET Enterprise 6.0.3 is the network-management software electric utilities use to monitor and manage 
the industrial wireless networks connecting substations and distribution automation. It ships with factory-default 
admin/admin credentials with no forced password change, and the resource-management console builds the target file path 
by raw string concatenation with no normalization. Because Tomcat runs as root with autoDeploy enabled, an attacker can 
upload a JSP file into a new web application directory and execute arbitrary commands as root. Dynamically verified 
with uid=0(root).

Impact: Full compromise of the power-network management host as root. The attacker can read the host filesystem, 
execute arbitrary commands, and gain control of the system a utility relies on to manage communications with its grid.

Advisory: https://0day-rubbish.com/blog/ge-pulsenet-resource-file-path-traversal-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

Vendor has been notified. CVE ID is pending.

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/