CVE-2021-47729
📋 TL;DR
This stored cross-site scripting vulnerability in Selea Targa IP OCR-ANPR cameras allows attackers to inject malicious HTML and JavaScript via the 'files_list' parameter. When exploited, attackers can execute arbitrary scripts in victims' browser sessions, potentially stealing session cookies or performing actions as authenticated users. Organizations using affected Selea camera models are vulnerable.
💻 Affected Systems
- Selea Targa IP OCR-ANPR Camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, take full control of the camera system, pivot to internal networks, or deploy ransomware on connected systems.
Likely Case
Session hijacking, credential theft, defacement of camera web interface, or unauthorized access to camera footage and settings.
If Mitigated
Limited to interface disruption or minor data exposure if proper network segmentation and web application firewalls are in place.
🎯 Exploit Status
Exploit requires authentication to access /cgi-bin/get_file.php endpoint; public exploit code available at Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.selea.com
Restart Required: Yes
Instructions:
1. Contact Selea support for firmware updates. 2. Download latest firmware from vendor portal. 3. Upload firmware via camera web interface. 4. Reboot camera after update.
🔧 Temporary Workarounds
Web Application Firewall
allDeploy WAF with XSS filtering rules to block malicious payloads
Input Validation
allImplement input sanitization for 'files_list' parameter if custom web interface modifications possible
🧯 If You Can't Patch
- Segment camera network from critical systems using VLANs/firewalls
- Disable camera web interface if not required; use API-only access
🔍 How to Verify
Check if Vulnerable:
Send POST request to /cgi-bin/get_file.php with XSS payload in files_list parameter and check if script executesCheck Version:
Check firmware version in camera web interface under System > InformationVerify Fix Applied:
Test same payload after update; script should be sanitized or blocked📡 Detection & Monitoring
Log Indicators:
- POST requests to /cgi-bin/get_file.php with script tags or JavaScript in parameters
- Unusual file listing requests
Network Indicators:
- HTTP traffic to camera IP on port 80/443 with suspicious POST parameters
- Outbound connections from camera to unknown IPs after exploitation
SIEM Query:
source="camera_logs" AND (url="/cgi-bin/get_file.php" AND method="POST" AND (param="files_list" AND value CONTAINS "<script>" OR "javascript:"))