HBGK DVR V3.0.0 build20161206 - Authentication Bypass

vendor:

DVR

by:

RAT - ThiefKing

7,5

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: DVR

Affected Version From: V2.3.1 build20160927

Affected Version To: V3.0.0 build20161206

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: V2.3.1 build20160927, V3.0.0 build20161206

2017

HBGK DVR V3.0.0 build20161206 – Authentication Bypass

Any registered user can login when edit cookie userInfo. When login successful, DVR saves cookie: userInfo + webport with value: base64 encode (user:pass). But Dvr does not check pass with cookie. When not yet login, you add a cookie: userInfoXX (xx : web port) with value base64 encode (admin: any words). And go url: http://dvr-domain.dynns.com:XX/doc/page/main.asp. It will Authentication Bypass.

Mitigation:

Update to Firmware version V3.0.0 build20170925

Source

Exploit-DB raw data:

# Exploit Title: HBGK DVR V3.0.0 build20161206  - Authentication Bypass
# Date: 24-09-2017
# Vendor Homepage: http://www.hbgk.net/en/
# Exploit Author: RAT - ThiefKing
# Contact: https://www.facebook.com/cctvsuperpassword
# Website: http://tromcap.com
# Category: webapps
# Tested on: V2.3.1 build20160927, V3.0.0 build20161206
# Shodan Dork: NVR Webserver

1. Description
- Any registered user can login when edit cookie userInfo

2. Proof of Concept
- When login successful: DVR save cookie : userInfo + webport with 
value: base64 encode (user:pass)
Ex: http://dvr-domain.dynns.com:85 --> When login successful (user: 
admin, pass: admin), DVR will save cookie: userInfo85 with value 
YWRtaW46YWRtaW4= (admin:admin <-- base64 decode)
But Dvr not check pass with cookie. When not yet login, you add a 
cookie: userInfoXX (xx : web port) with value base64 encode (admin: any 
words). And go url: http://dvr-domain.dynns.com:XX/doc/page/main.asp. It 
will Authentication Bypass

3. Solution:
Update to Firmware version V3.0.0 build20170925