CVE-2024-45178
📋 TL;DR
CVE-2024-45178 is a path traversal vulnerability in za-internet C-MOR Video Surveillance 5.2401 that allows authenticated attackers to download arbitrary files from the system. The vulnerability exists in multiple scripts including download-bkf.pml and show-movies.pml due to insufficient input validation. This affects organizations using vulnerable versions of C-MOR video surveillance software.
💻 Affected Systems
- za-internet C-MOR Video Surveillance
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could download sensitive system files, configuration files, or credential data, potentially leading to full system compromise and surveillance footage theft.
Likely Case
Authenticated users or attackers who gain authentication can exfiltrate sensitive configuration files, backup data, or surveillance footage.
If Mitigated
With proper network segmentation and access controls, impact is limited to the web application server files accessible to the www-data user.
🎯 Exploit Status
Exploitation requires authentication but is straightforward via path traversal in bkf and cam parameters. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. Apply any available patches
3. Monitor za-internet security advisories
4. Consider upgrading to latest version if patch not available
🔧 Temporary Workarounds
Input Validation Enhancement
linuxImplement strict input validation for file path parameters in affected scripts
# Modify download-bkf.pml and show-movies.pml to validate file paths
# Example: if ".." in param: reject request
# Implement allowlist of permitted file paths
Web Server Configuration
linuxRestrict web server permissions and implement directory traversal protections
# In Apache: Options -Indexes -FollowSymLinks
# In Nginx: disable autoindex
# Set open_basedir restrictions in PHP if applicable
🧯 If You Can't Patch
- Implement network segmentation to isolate C-MOR systems from sensitive networks
- Enable strict access controls and monitor for unusual file download patterns
🔍 How to Verify
Check if Vulnerable:
Test if you can access files outside intended directories using path traversal sequences in bkf or cam parametersCheck Version:
# Check C-MOR version in web interface or configuration files
# Typically found in /var/www/html/ or similar web directoryVerify Fix Applied:
Attempt path traversal attacks after applying fixes; successful attacks should be blocked📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Multiple requests with ".." sequences in parameters
- Access to sensitive system files from web user www-data
Network Indicators:
- Unusually large downloads from C-MOR web interface
- Requests to non-standard file paths
SIEM Query:
web.url:*download-bkf.pml* AND (web.param:*..* OR web.param:*../*)