Executive Summary

This vulnerability exists in FLIR Thermal Camera F/FC/PT/D series firmware version 8.0.0.64 and related software. It is caused by improper input validation in the web API endpoint `/api/xml`, specifically in the `readFile` function in `/var/www/data/controllers/api/xml.php`. The function accepts a `file` parameter that is not properly sanitized or verified before being used to read files from the local filesystem. As a result, an unauthenticated attacker can exploit this flaw to read arbitrary files on the device, including sensitive system files, configuration files, password hashes, and user credentials, without needing any authentication. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to significant information disclosure risks. An attacker can remotely and without authentication read arbitrary files on the affected FLIR Thermal Camera devices. This includes sensitive files such as system configuration files, password hashes, SSH authorized keys, user credential files containing MD5 hashed usernames and passwords, and other critical system scripts. Exposure of such information can enable attackers to gain further unauthorized access, compromise the device, or use the disclosed information to attack other systems in the network. The vulnerability poses a medium to high risk of information exposure and potential system compromise. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the vulnerable API endpoint on the FLIR Thermal Camera using HTTP requests that include the 'file' parameter to read arbitrary files. For example, you can use curl commands to request sensitive files such as /etc/passwd or configuration files via the API endpoint `/api/xml.php`. A sample command to test the vulnerability is: curl "http://<camera-ip>/api/xml.php?file=/etc/passwd". If the contents of the file are returned without authentication, the system is vulnerable. Monitoring network traffic for such suspicious requests to `/api/xml.php` with a 'file' parameter can also help detect exploitation attempts. [1, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable API endpoint `/api/xml.php` by implementing network-level controls such as firewall rules to limit access only to trusted users or management networks. Additionally, updating the firmware and software of the FLIR Thermal Camera to versions where this vulnerability is patched is recommended. If updates are not immediately available, disabling or restricting the web interface or API access temporarily can reduce exposure. Changing default credentials is also advised to prevent further unauthorized access. [1, 2, 3]

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to read arbitrary files on FLIR Thermal Cameras, potentially exposing sensitive system information, user credentials, and configuration data. Such unauthorized disclosure of sensitive data could lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information. However, the provided resources do not explicitly discuss compliance impacts or regulatory considerations. [1, 2, 3]

Useful 0 Not Useful 0