Headline
CVE-2017-20050: Full Disclosure: Axis Camera Multiple Vulnerabilities
A vulnerability has been found in AXIS P1204, P3225, P3367, M3045, M3005 and M3007 and classified as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to improper access controls. The attack can be initiated remotely. It is recommended to upgrade the affected component.
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev
Full Disclosure mailing list archives
From: David Wearing <wearing () google com>
Date: Thu, 16 Mar 2017 16:47:27 +1100
Introduction
============
Vulnerabilities were identified in the camera software by Axis. These were discovered during a black box assessment and therefore the vulnerability list should not be considered exhaustive; observations suggest that it is likely that further vulnerabilities exist.
Affected Software And Versions
==============================
Model P1204, software versions <= 5.50.4
Model P3225, software versions <= 6.30.1
Model P3367, software versions <= 6.10.1.2
Model M3045, software versions <= 6.15.4.1
Model M3005, software versions <= 5.50.5.7
Model M3007, software versions <= 6.30.1.1
CVE
===
No CVEs have been assigned to these vulnerabilities.
Vulnerability Overview
======================
Axis01: No cross-site request forgery protections
Axis02: Bypass manual checks for XSS
Axis03: Web services run as root
Axis04: Script editor function allows for arbitrary write as root on successful CSRF attack
Axis05: root setuid .CGI scripts and binaries present
Axis06: Inability to disable the http interface
Vulnerability Details
=====================
- Axis01: No cross-site request forgery protections
Axis software does not have any cross-site request forgery protection within the management interface. Axis provide guidance on risk mitigation for CSRF only.
https://www.axis.com/files/faq/Advisory_Cross-Site_Request_Forgery.pdf
- Axis02: Bypass manual checks for XSS
Axis software on the camera has client-side JavaScript to try and remove XSS payloads. No server-side security checks are present. Viewers or lower privileged users of cameras exposed to the internet or corporate networks may be able to store persistent XSS payloads.
Example of code in language_incl.js used to detect and remove malicious javaScript shown below:
if( data.toLowerCase().indexOf(\"<script\") != -1 || data.toLowerCase().indexOf(\"</script\") != -1 )
- Axis03: Web service runs as root
The versions of Axis software tested have a BOA server (boa) running as root. BOA is an ancient web server and no longer maintained since approx.
- Fuzzing of the process using off-the-shelf fuzzers result in crashes that have not yet been investigated further.
Axis software versions >5.70 have replaced BOA with Apache.
- Axis04: Script editor function allows for arbitrary write as root on successful CSRF attack
A script editor function “/admin-bin/editcgi.cgi” can be used to write as root to the device, due to Axis01 lack of CSRF protection, this can be exploited to write over /etc/shadow and obtain root access to the device, as well as backdoor the device.
Proof of concept to overwrite /etc/shadow file:
<body> <form action="https://<ip-of-axis-camera|hostname>/admin-bin/editcgi.cgi?file=/etc/shadow" method="POST" > <input type="hidden" name="save_file" value="/etc/shadow" /> <input type="hidden" name="mode" value="0100600" /> <input type="hidden" name="convert_crlf_to_lf" value="on" /> <input type="hidden" name="content" value="#####INPUT HTML ENCODED SHADOW HERE##### " /> <input type="submit" value="Submit request" /> </form> </body>
- Axis05: root setuid .CGI scripts and binaries present
Multiple root setuid .CGI scripts and binaries are present. The CGI scripts manage web session temp files,group memberships and functionality of the camera. Exploitable vulnerabilities in any will provide root access to the camera.
E.g /axis-cgi/admin/param.cgi & /axis-cgi/admin/pwdgrp.cgi which allows for changing user and group passwords.
- Axis06: Inability to disable the HTTP interface
No option existed in Axis software to disable the HTTP interface. The web server will always listen on all network interfaces of the camera, which makes these cameras trivial to find on the internet e.g. using Shodan.
E.g port 80 is listening and /httpDisabled.shtml is always accessible.
Axis advise to move the web server listening port to another port.
Mitigation
==========
Axis released zero advisories related to the issues reported here.
Axis recommends following their hardening guide available on: https://www.axis.com/mu/en/support/product-security
For the vulnerabilities related to Axis02, Axis03 and Axis06 Axis has recommended to upgrade Axis software to versions >5.70 or use the new Axis platform with >7.10 versions. Versions other than those listed here have not been tested to confirm these vulnerabilities have been fixed.
Author
======
The vulnerabilities were discovered by David Wearing from Google Security Team.
Timeline
========
2016/11/24 - Security report sent to Axis with 90 day disclosure deadline (2017/02/24).
2016/12/02 - Axis acknowledges report and starts working on the issues.
2016/12/06 - Pinged for patch ETA.
2016/12/09 - Pinged for patch ETA.
2017/01/11 - Pinged for patch ETA.
2017/01/12 - Response from Axis Security listing multiple issues as having been fixed in the new firmware versions. Redesign of CGI scripts to be interfaces confirmed.
2017/01/25 - Send query regarding the lack of CSRF protections and if changes to handling of XSS was to occur.
2017/02/28 - Request to Axis on any advice or mitigations they want to include in the post.
2017/03/02 - Pinged Axis.
2017/03/02 - Response from Axis including advice on mitigation of CSRF.
2017/03/05 - Review of mitigations provided to Axis
2017/03/10 - Discussions with Axis on post.
2017/03/15 - Public disclosure.
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Axis Camera Multiple Vulnerabilities David Wearing (Mar 16)