AXIS P1354 5.90.1.1 mod_include fileUpload.shtml unrestricted upload ⚔ [Disputed]

Summaryinfo

A vulnerability was found in AXIS P1354 5.90.1.1. It has been rated as critical. The impacted element is an unknown function of the file fileUpload.shtml of the component mod_include. This manipulation causes unrestricted upload. This vulnerability is tracked as CVE-2018-9156. The attack is possible to be carried out remotely. No exploit exists. It is still unclear if this vulnerability genuinely exists.

Detailsinfo

A vulnerability classified as critical was found in AXIS P1354 5.90.1.1. Affected by this vulnerability is an unknown function of the file fileUpload.shtml of the component mod_include. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

** DISPUTED ** An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality.

The weakness was disclosed 04/01/2018 (Website). It is possible to read the advisory at slideshare.net. This vulnerability is known as CVE-2018-9156 since 03/31/2018. The attack can be launched remotely. The successful exploitation requires a single authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• AXIS

Name

• P1354

Version

• 5.90.1.1

License

• free

Website

• Vendor: https://www.axis.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion