Repository files navigation

Gurux GXDLMS Director is an open-source Windows program for interacting with energy metersthrough the use of DLMS/COSEM protocol.

The software has a remote update functionality for add-in DLLs as well as for files containingOBIS codes (device-specific definitions needed to interact with the smart meters).

Summary

All version of Gurux GXDLMS Director prior to 8.5.1905.1301 contain an update mechanismfor add-ins and OBIS codes which works over an unencrypted HTTP connection. Additionally, allversions contain a path traversal bug which happens when downloading OBIS codes. Thosevulnerabilities can be used by the attacker to achieve code execution.

Description

A man-in-the-middle attacker (e.g. a malicious Wi-Fi network operator) can prompt the user todownload updates by modifying the contents ofgurux.fi/obis/files.xml andgurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files.In the case of add-ins (if the user is using those), this will lead to code execution. In case ofOBIS codes (which the user is always using as they are needed to communicate with the energy meters),the attacker can achieve code execution by exploiting a path traversal vulnerability.

When downloading OBIS codes, the program does not verify that the downloaded files are actual OBIScodes and doesn’t check for path traversal. This allows the attacker to send executable files andplace them in an autorun directory (run after reboot), or to place DLLs inside the existing GXDLMSDirector installation (run on next execution of GXDLMS Director). This can be used to achieve codeexecution even if the user doesn’t have any add-ins installed.

Reproduction

1. Start an HTTP server.
2. Inside its root directory, create a directory calledobis.
3. Create a fileobis/files.xml with the following contents:

<files>  <filemodified=”28-09-2099″name=”Iskraemeco”>../../../../../../../../../../Users/Public/Documents/test.txt</file></files>

4. Create a directoryUsers/Public/Documents.
5. Create a fileUsers/Public/Documents/test.txt.
6. On a Windows machine, edit the fileC:\Windows\system32\drivers\etc\hosts and add thefollowing line to it:127.0.0.1 gurux.fi (if your HTTP server is not the same as your Windows machine,replace127.0.0.1 with the server’s IP).
7. Start Gurux GXDLMS Director. When prompted to download an update, accept.
8. Verify thatC:\Users\Public\Documents\ now contains filetest.txt.

Remedy

Update Gurux GXDLMS Director to the newest version.