Executive Summary

This vulnerability is a cross-site request forgery (CSRF) in the Selea Targa IP OCR-ANPR Camera that allows attackers to create administrative users without authentication. An attacker can craft a malicious web page that, when visited by a logged-in user, submits a form to add a new admin user with full system privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP POST requests to the camera's 'save_params.php' endpoint that include multipart/form-data content with configuration files attempting to add new administrative users. Specifically, look for suspicious POST requests that contain user credentials or rights level parameters indicating admin creation. Network traffic analysis tools like Wireshark or tcpdump can be used to capture such HTTP requests. For example, using tcpdump to filter HTTP POST requests to the camera's IP: tcpdump -i <interface> -A 'tcp port 80 and (((ip dst <camera_ip>) and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)))' and then inspecting the payload for 'save_params.php' and user creation parameters. Additionally, checking the camera's user list via its web interface or API for unexpected admin users can help detect exploitation. [1, 3, 5]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include: 1) Updating the camera firmware and CPS software to the latest versions where the vendor has addressed this vulnerability, as most issues were reviewed and fixed in newer releases. 2) Restricting access to the camera's web interface to trusted networks only, preventing exposure to untrusted users. 3) Educating users to avoid visiting untrusted or suspicious websites while logged into the camera's interface to reduce risk of CSRF attacks. 4) Implementing network-level protections such as firewall rules to block unauthorized HTTP POST requests to the camera's administrative endpoints. 5) If possible, disabling or limiting the web interface functionality that allows user creation until patches are applied. [3, 5]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow attackers to gain administrative access to the affected camera system without authentication. This can lead to unauthorized control over the device, potentially compromising the security and functionality of the system.

Useful 0 Not Useful 0