CVE-2024-45177
📋 TL;DR
CVE-2024-45177 is a persistent cross-site scripting vulnerability in za-internet C-MOR Video Surveillance software that allows attackers to inject malicious scripts into camera configuration pages. These scripts execute when other users view those pages, potentially stealing credentials or performing unauthorized actions. Organizations using affected C-MOR versions for video surveillance are impacted.
💻 Affected Systems
- za-internet C-MOR Video Surveillance
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, take full control of the surveillance system, manipulate video feeds, or pivot to internal networks.
Likely Case
Attackers steal session cookies or credentials to gain unauthorized access to the surveillance system, potentially viewing or manipulating camera feeds.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before execution, preventing exploitation.
🎯 Exploit Status
Exploitation requires authenticated access to the web interface. Public proof-of-concept details are available in the referenced advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Monitor vendor website for security updates
2. Apply patches when available
3. Verify fix by testing XSS payloads in camera configuration
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement server-side validation and proper output encoding for all user inputs in camera configuration fields
Content Security Policy
allImplement strict Content Security Policy headers to restrict script execution
Add header: Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Restrict network access to C-MOR web interface using firewall rules
- Implement web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Test camera configuration fields with XSS payloads like <script>alert('XSS')</script> and check if script executes when viewing the pageCheck Version:
Check C-MOR version in web interface or configuration filesVerify Fix Applied:
Retest with XSS payloads after applying controls - scripts should not execute and should be properly encoded in output📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript in camera configuration requests
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests containing script tags to camera configuration endpoints
- Unusual traffic patterns to /cgi-bin/ paths
SIEM Query:
source="c-mor" AND (http_uri="*cgi-bin*" AND http_query="*<script>*")