vendor:
NVR
by:
B1t
8,8
CVSS
HIGH
Password Disclosure
200
CWE
Product Name: NVR
Affected Version From: B3118P26C00510
Affected Version To: B3220P11
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux, Mac
2020
Uniview NVR remote passwords disclosure
The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structure. In addition, the users' passwords are both hashed and also stored in a reversible way. The POC below remotely downloads the device's configuration file, extracts the credentials and decodes the reversible password strings using a crafted map. It is worth mention that when you login, the javascript hashes the password with MD5 and pass the request. If the script does retrieve the hash and not the password, you can intercept the request and replace the generated MD5 with the one disclosed using this script.
Mitigation:
Enforce authorization on the main.cgi file when requesting json data and ensure that passwords are not stored in a reversible way.
