CVE-2019-9106
📋 TL;DR
This vulnerability allows remote attackers to execute or include local PHP files on SAET Impianti Speciali TEBE Small supervisor devices through path traversal in the WebApp interface. Attackers can read sensitive files like index.php using PHP filter wrappers. Affects organizations using SAET TEBE Small 05.01 build 1137 devices with WebApp v04.68.
💻 Affected Systems
- SAET Impianti Speciali TEBE Small Supervisor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing remote code execution, credential theft, and device takeover leading to industrial control system manipulation.
Likely Case
Information disclosure of PHP source code, configuration files, and potentially sensitive credentials stored in web application files.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external exploitation attempts.
🎯 Exploit Status
The vulnerability is demonstrated with a simple URL manipulation using PHP filter wrappers. No authentication required and exploitation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
Contact SAET Impianti Speciali for firmware updates or security patches. Check their website for updated versions of TEBE Small software.
🔧 Temporary Workarounds
Network Segmentation
allIsolate SAET TEBE Small devices from untrusted networks and the internet
Access Control Lists
allImplement strict firewall rules to limit access to the web interface
🧯 If You Can't Patch
- Implement network segmentation to isolate affected devices in a separate VLAN
- Deploy a web application firewall (WAF) with rules to block PHP filter wrapper requests
🔍 How to Verify
Check if Vulnerable:
Access the device web interface and attempt to use the PHP filter wrapper payload: menu=php://filter/convert.base64-encode/resource=index.phpCheck Version:
Check the web interface login page or device information page for version detailsVerify Fix Applied:
Test if the PHP filter wrapper payload no longer returns base64-encoded PHP source code📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'php://filter' or 'convert.base64-encode' in URL parameters
- Unusual file access patterns to PHP files
Network Indicators:
- HTTP requests with suspicious PHP wrapper parameters to the device web interface
SIEM Query:
http.url:*php://filter* AND http.url:*convert.base64-encode* AND dst_ip:[DEVICE_IP]🔗 References
- https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/
- https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf
- https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/
- https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf
