Return nTemplatingEngine(bytes, responseHeaders, queryString) Using (FileStream f = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.ReadWrite)) This enables an attacker to gain code execution and eventually spawn a reverse The `mono/t4` templating engine allows the use of `C#` to evaluate code.

This is where the File Inclusion can be escalated to a Remote Code Execution. `getMimeType` will return `t4` if the included file is ending with an extension Import/export procedure or rendered as `mono/t4` template.

ForĮxample using `\ipaddress` you can include files from a remote samba server.įurther down the request flow, the application is checking for the MIME type ofĭepending on the MIME type the content is either sent through a Net function `Path.Combine` also is able to concatenate remote targets. String fileName = Path.Combine(this.RootDirectory(), getfileName) String getfileName = (path = '/') ? 'index.html' : path.Substring(1).Replace('/', Public MccHttpServerResult GetFile(string path, string acceptEncoding, string queryString = null) The following code snippet shows the vulnerable part of this function: Include local files, as well as remote files (SMB). (`Path.Combine`) without proper sanitization. The user controllable path is handed to a path concatenation function This interface is meant to control and monitor the material flow. NET based software spawns a web interface listening on port 8088. Systems to an automated intralogistics system connected to production lines andĭriverless vehicles, intelligent energy management for the automated stackerĬranes and modern system visualization, the Kardex Control Center modules offerįlexible solutions for your warehouse management. Kardex Mlog’s modular software solution Kardex Control Center manages materialįlow and warehouse management processes faster and more efficiently.įrom manual block warehouse and interface networking with intelligent partner Vulnerability Type: Improper Control of Generation of Code ('RFI') - CWE-94ĬVSSv2 Severity: AV:A/AC:L/Au:N/C:C/I:C/A:C - Score 8.3ĬVSSv3 Severity: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Score 9.6Īuthors of Advisory: Patrick Hener & Nico Viakowski Tested Version: 5.7.12+0-a203c2a213-masterįixed Version: inline patch - no new version number

By Thread Remote Code Execution in Kardex MLOG

Remote packet capture tool