CVE-2024-45170
📋 TL;DR
CVE-2024-45170 is an improper access control vulnerability in za-internet C-MOR Video Surveillance software that allows low-privileged users to perform administrative actions by bypassing client-side restrictions. Attackers can send direct HTTP requests to execute privileged functions like downloading backups or changing configurations. This affects all organizations using vulnerable versions of C-MOR Video Surveillance.
💻 Affected Systems
- za-internet C-MOR Video Surveillance
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control, download sensitive surveillance footage and backups, modify system configurations to disable security features, and potentially pivot to other systems.
Likely Case
Unauthorized users access administrative functions to download backup files containing sensitive data, modify surveillance settings, or disrupt monitoring operations.
If Mitigated
With proper network segmentation and access controls, impact is limited to the C-MOR system itself without lateral movement.
🎯 Exploit Status
Exploitation requires low-privileged credentials but involves simple HTTP request manipulation. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest patched version
Vendor Advisory: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-024.txt
Restart Required: Yes
Instructions:
1. Check vendor website for security updates. 2. Backup current configuration. 3. Apply the latest security patch. 4. Restart C-MOR services. 5. Verify access controls are properly enforced.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to C-MOR web interface to authorized management networks only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
User Account Review
allReview and remove unnecessary low-privileged accounts
Review /etc/passwd and user management interface
Disable unused accounts
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the C-MOR web interface
- Monitor for unusual administrative actions from non-admin accounts and implement alerting
🔍 How to Verify
Check if Vulnerable:
Test if low-privileged user can access administrative endpoints via direct HTTP requests (e.g., /admin/backup, /admin/config)Check Version:
Check web interface footer or system information page for version numberVerify Fix Applied:
Verify that low-privileged users receive proper access denied responses when attempting administrative functions📡 Detection & Monitoring
Log Indicators:
- Administrative actions from non-admin user accounts
- Access to /admin/* endpoints from low-privileged users
- Failed access control checks in application logs
Network Indicators:
- HTTP requests to administrative endpoints from unexpected source IPs
- Unusual backup download requests
SIEM Query:
source="c-mor-logs" AND (uri_path="/admin/*" AND user_role!="admin")🔗 References
- https://www-syss-de.translate.goog/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-024.txt
- http://seclists.org/fulldisclosure/2024/Sep/12
