Philipp Espernberger

An incorrect authorization issue exists in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, such as activating boxes outside of their authorized branch.

The software uses weak custom cryptographic algorithms and hard-coded cryptographic keys to protect communication. An attacker in an adversary-in-the-middle position can decrypt data traffic. It is possible to break the encryption/decryption routine to decrypt messages without the encryption key or intercept sufficient messages to discover the key itself.

The device uses RS-485 communication between the server and the microcontroller without cryptographic protection. An attacker with access to the communication path can sniff RS-485 messages and replay previously observed messages. This allows for the spoofing of messages, such as a "quit alarm" message, to continuously deactivate the safe alarm.

The issue allows attackers to call restricted functions and perform unauthenticated uploads via the "Upload2.ashx" endpoint or access content uploaded by other users through "View.aspx" after using "Ajax.asmx/SaveGrantAccessList".

The issue involves multiple Stored Cross-Site Scripting (XSS) vulnerabilities in various components, including Disclaimer, Search Function, Comments, Batch editing tool, Content Creation, Related Media, Create new user, and Change Username.

The issue allows directory traversal to read arbitrary local files through the GetFile.aspx page.

The issue discloses sensitive information related to the `ON` cookie, which can be found in the HTML source code for "Default.aspx" in certain situations, and the "WhoAmI" endpoint, which can lead to path disclosure.

The issue allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the `ON` cookie. A brute-force attack can calculate a value that provides permanent access.

The issue allows a remote attacker, who is a publisher or admin, to obtain access to all records stored in the database and execute arbitrary SQL commands via Search, specifically through the `flt` parameter in the "StatisticsResults.aspx" page.

A Reflected Cross-Site Scripting (XSS) issue exists via any metadata filter field, for example, when searching within Default.aspx using the `r` or `fo` parameter. This allows for malicious scripts to be reflected off the server, potentially leading to the execution of unwanted actions on the client-side.

The issue allows HTML injection.

The issue allows directory traversal, enabling the reading of arbitrary local files via the export function or man.tcl.