AXIS AXIS OS up to 11.6 VAPIX API manageoverlayimage.cgi path traversal

Summaryinfo

A vulnerability, which was classified as critical, has been found in AXIS AXIS OS up to 11.6. Affected by this vulnerability is an unknown functionality of the file manageoverlayimage.cgi of the component VAPIX API. Performing a manipulation results in path traversal. This vulnerability was named CVE-2023-21417. The attack may be initiated remotely. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as critical, was found in AXIS AXIS OS up to 11.6. This affects an unknown functionality of the file manageoverlayimage.cgi of the component VAPIX API. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on integrity, and availability. The summary by CVE is:

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account. The impact of exploiting this vulnerability is lower with operator service accounts and limited to non-system files compared to administrator-privileges. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

The weakness was presented 11/21/2023. It is possible to read the advisory at axis.com. This vulnerability is uniquely identified as CVE-2023-21417 since 11/04/2022. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Applying a patch is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• AXIS

Name

• AXIS OS

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6

License

• free

Website

• Vendor: https://www.axis.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion