We have discovered a directory traversal vulnerability that affects Genie Access’ WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera. This security vulnerability can act as the first step to full device compromise and has been assigned CVE-2019-7315.
Proof of concept (PoC) of path traversal vulnerability discovered
The directory traversal vulnerability can be exploited via the web management interface for the IP camera, using a URL as follows:http://www.example.com/../../../../../etc/shadow
Here is a screenshot showing the contents of the shadow file for a WIP3BVAF IP camera, including the root password hash:
As the WIP3BVAF IP camera makes use of a weak hashing algorithm (DES), it is relatively easy to brute force the hash and obtain the cleartext password, especially if a weak password is in use. Once the password has been recovered, it is possible to obtain a root shell on the camera via telnet:
From here, the username and plaintext password for the web interface can be retrieved by using a tool such as strings against the /mnt/mtd/flash/config.dat file. Once these have been obtained, administrative access to the management interface is possible, where the camera feeds can be viewed and disabled, or the camera configuration adjusted.
Models with the directory traversal vulnerability
All firmware versions for this particular model (3.x.x) are affected.
While a firmware version (4.2.1) has been released to address the security vulnerability in later camera models, this version is not transferable to the WIP3BVAF model. This is due to the fact that the WIP3BVAF model is based on H.264 encoding, while later models of camera manufactured by Genie Access make use of H.265 encoding.
The WIP3BVAF is no longer manufactured by Genie Access and can be considered as end of life. According to the manufacturer, no patch addressing this vulnerability will be released.
Conclusion
As demonstrated, the path traversal vulnerability can be the potential starting point for complete compromise of the WIP3BVAF camera.
Since no fix will be forthcoming due to the camera being end of life and no longer manufactured, it is advisable to refrain from using this model. If this isn’t an option, a sufficiently isolated VLAN should be considered for the camera to prevent it being easily accessible, and a strong, unique password should be set for the root user.
Genie Access Directory Traversal Vulnerability Timeline
- Vulnerability discovered: 7 Jan 2019
- Genie Access informed: 13 Jan 2019
- Genie Access response detailing no fix would be forthcoming: 16 Jan 2019
- Nettitude public disclosure: 29 May 2019
