CVE-2018-15486
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform Local File Inclusion (LFI) and file modification on KONE Group Controller devices by manipulating the 'name' parameter in the file endpoint. It affects KONE KGC devices with versions before 4.6.5, potentially exposing sensitive files and enabling further system compromise.
💻 Affected Systems
- KONE Group Controller (KGC)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including remote code execution, data theft, and device takeover leading to physical safety risks in elevator/access control systems.
Likely Case
Unauthorized access to sensitive configuration files, credential theft, and potential denial of service through file manipulation.
If Mitigated
Limited to information disclosure if proper network segmentation and access controls prevent external exploitation.
🎯 Exploit Status
Exploitation requires simple HTTP parameter manipulation with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.6.5 or later
Vendor Advisory: https://www.kone.com/en/vulnerability.aspx
Restart Required: Yes
Instructions:
1. Contact KONE support for patch availability. 2. Backup current configuration. 3. Apply firmware update to version 4.6.5 or later. 4. Restart the KGC device. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allIsolate KGC devices from untrusted networks and restrict HTTP access to authorized management systems only.
Access Control Lists
allImplement firewall rules to restrict HTTP access to KGC devices from specific IP addresses only.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate KGC devices from all untrusted networks
- Deploy web application firewall (WAF) rules to block LFI patterns and parameter manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or console. If version is below 4.6.5, device is vulnerable.Check Version:
Check via web interface at http://<kgc-ip>/status or consult device documentation for CLI commands.Verify Fix Applied:
Verify firmware version is 4.6.5 or later and test that file endpoint no longer accepts manipulated 'name' parameters.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to file endpoint with unusual 'name' parameter values
- Multiple failed file access attempts
- Unauthorized file modification attempts
Network Indicators:
- HTTP traffic to KGC devices with parameter manipulation patterns
- Unusual file paths in HTTP requests
SIEM Query:
source="kgc-http-logs" AND (uri="/file" OR uri="/file/") AND (param_name="name" AND param_value CONTAINS "../")