za-internet C-MOR Video Surveillance 5.2401/6.00PL01 Web Interface settimezone.pml city os command injection

Summaryinfo

A vulnerability was found in za-internet C-MOR Video Surveillance 5.2401/6.00PL01 and classified as critical. The affected element is an unknown function of the file settimezone.pml of the component Web Interface. The manipulation of the argument city results in os command injection. This vulnerability is known as CVE-2024-45179. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in za-internet C-MOR Video Surveillance 5.2401/6.00PL01. It has been classified as critical. Affected is an unknown code of the file settimezone.pml of the component Web Interface. The manipulation of the argument city with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command injection attacks. It was found out that different functionality is vulnerable to OS command injection attacks, for example for generating new X.509 certificates, or setting the time zone. These OS command injection vulnerabilities in the script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data (e.g., the city parameter). The OS command injection vulnerability in the script settimezone.pml or setdatetime.pml (e.g., via the year parameter) requires an administrative user for the C-MOR web interface. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges.

The advisory is shared for download at syss.de. This vulnerability is traded as CVE-2024-45179 since 08/22/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/10/2024). The MITRE ATT&CK project declares the attack technique as T1202.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Video Surveillance Software

Vendor

• za-internet

Name

• C-MOR Video Surveillance

Version

• 5.2401
• 6.00PL01

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion