full-disclosure - [FD] XML Injection, AoF and BF vulnerabilities in Hikvision DS-2CD2012-I

Open Source and information security mailing list archives

Date: Fri, 15 May 2015 21:58:57 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>,
	<fulldisclosure@...lists.org>
Subject: [FD] XML Injection,
	AoF and BF vulnerabilities in Hikvision DS-2CD2012-I

Hello list!

There are vulnerabilities in Hikvision DS-2CD2012-I.

These are XML Injection, Abuse of Functionality and Brute Force 
vulnerabilities. All these vulnerabilities are present in other IP cameras 
and DVR of Hikvision.

-------------------------
Affected vendors:
-------------------------

Hikvision
http://www.hikvision.com

-------------------------
Affected products:
-------------------------

Vulnerable are the next models with different versions of firmware: 
Hikvision DS-2CD2012-I and other IPC, DVR and NVR of Hikvision, the list of 
models I wrote earlier (http://seclists.org/fulldisclosure/2015/Mar/161).

As Hikvision answered me at 01.03.2015, they didn't want to fix Abuse of 
Functionality vulnerability, but they will fix Brute Force vulnerability in 
firmware in the beginning of this year. And they fixed XML Injection 
vulnerability last year.

Hikvision fixed XML Injection in firmware for DVR/NVR in V3.2.0 and for IPC 
in V5.2.0 and fixed Brute Force in the last firmware.

----------
Details:
----------

XML Injection (WASC-23):

http://site/ISAPI/%3C/requestURL%3E%3Clink%3Ehttp://site%3C/link%3E%3CrequestURL%3E/

It can be used for XML Injection and XSS attacks.

Abuse of Functionality (WASC-42):

Login is persistent: admin (only logins for users can be changed). Which 
simplify Brute Force attack.

Brute Force (WASC-11):

In login form http://site/doc/page/login.asp there is no protection against 
Brute Force attacks. Which allows to pick up password (if it was changed 
from default).

I found this and other web cameras during summer to watch terrorists 
activities in Donetsk and Lugansks regions of Ukraine and also I took under 
control web cameras in Russia 
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2015-April/009090.html).

I mentioned about these vulnerabilities at my site 
(http://websecurity.com.ua/7346/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives