CVE-2024-47261

Executive Summary

CVE-2024-47261 is a medium-severity vulnerability affecting Axis devices running the AXIS OS. The flaw resides in the VAPIX API endpoint uploadoverlayimage.cgi, which lacks proper input validation. An attacker can exploit this to upload arbitrary files, potentially blocking the creation of image overlays in the device’s web interface. This could lead to denial-of-service conditions for legitimate users trying to manage overlay images. The vulnerability was reported through the AXIS OS Bug Bounty Program by researcher 51l3nc3. No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) indicates that exploitation is not currently widespread, but the lack of a patch makes it a potential risk for unpatched devices.

Deep Dive & Mechanics

The vulnerability is a classic input validation flaw in the uploadoverlayimage.cgi CGI script. This script is part of the VAPIX API, which Axis devices use for remote management and configuration. The endpoint is designed to accept image files for overlay purposes (e.g., watermarks or logos on video streams). However, it fails to properly validate the file type, size, or content, allowing an attacker to upload arbitrary files.

Attack Flow:

1. The attacker sends a crafted HTTP POST request to http://<device>/axis-cgi/uploadoverlayimage.cgi with a malicious file payload.
2. The CGI script accepts the file without checking its MIME type, extension, or content.
3. The uploaded file is stored in the device’s filesystem, potentially overwriting legitimate overlay images or filling storage.
4. This blocks the creation of new overlays via the web interface, causing a denial-of-service condition for overlay management.

The vulnerability does not allow remote code execution or data exfiltration, but it disrupts a specific administrative function.

Vulnerable vs. Patched Code

No official patch has been released. The vulnerable code likely lacks file validation checks. A patched version would include:

• File type validation (e.g., checking MIME type against allowed types like image/png, image/jpeg).
• File size limits to prevent storage exhaustion.
• Content verification (e.g., reading magic bytes to confirm image format).
• Sanitization of filenames to prevent path traversal.

Vulnerable code snippet (conceptual):

// No validation of file type or size
if (upload_file) {
    save_to_disk(upload_file);
}

Patched code snippet (conceptual):

if (upload_file && is_valid_image(upload_file) && upload_file.size < MAX_SIZE) {
    save_to_disk(upload_file);
} else {
    return_error("Invalid file");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Axis device with the vulnerable firmware.
• Network connectivity to the device’s web interface.

Exploitation Steps:

1. Identify the target device (e.g., via Shodan dork: "Axis" "uploadoverlayimage.cgi").
2. Craft a malicious file (e.g., a large text file or a non-image binary).
3. Send the upload request using curl:

   curl -X POST -F "file=@malicious.txt" http://<target>/axis-cgi/uploadoverlayimage.cgi
   

4. Verify the attack by attempting to create an overlay via the web interface – it should fail.

Expected Outcome: The web interface’s overlay creation functionality is blocked.

Blue Team

Detection:

• Monitor HTTP POST requests to /axis-cgi/uploadoverlayimage.cgi with unusual file sizes or MIME types.
• Look for repeated upload attempts from the same IP.
• Check device logs for file upload errors or storage warnings.

Mitigation:

• Restrict network access to the VAPIX API using firewall rules.
• Implement web application firewall (WAF) rules to block non-image file uploads.
• Monitor for unauthorized file uploads using file integrity monitoring.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /axis-cgi/uploadoverlayimage.cgi with Content-Type: multipart/form-data.
  • Unusual file sizes (e.g., >10 MB) in upload requests.
  • Repeated upload attempts from a single IP address.

• File IOCs:

  • Unexpected files in the device’s overlay storage directory (e.g., /var/overlays/).
  • Files with non-image extensions (e.g., .txt, .exe) in overlay directories.

• Log IOCs:

  • Log entries indicating failed overlay creation due to storage issues.
  • Log entries with errors like "Invalid file type" (if logging is enabled).

Detection Engineering

YARA Rule

rule CVE_2024_47261_UploadOverlayImage {
    meta:
        description = "Detects malicious file uploads to Axis VAPIX uploadoverlayimage.cgi"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47261"
    strings:
        $s1 = "uploadoverlayimage.cgi" ascii wide nocase
        $s2 = "POST" ascii wide nocase
        $s3 = "multipart/form-data" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Axis VAPIX Overlay Upload Abuse
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects attempts to exploit CVE-2024-47261 by uploading files to Axis devices
author: Valters IT
logsource:
    category: webserver
    product: axis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/axis-cgi/uploadoverlayimage.cgi'
    condition: selection
falsepositives:
    - Legitimate overlay uploads by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47261 Axis VAPIX Overlay Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/axis-cgi/uploadoverlayimage.cgi"; http_uri; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict network access to the VAPIX API using firewall rules or VLAN segmentation.
2. Disable the overlay upload feature if not required, via device configuration.
3. Monitor logs for suspicious upload attempts.

Long-term Fix:

• Apply a firmware patch from Axis when available.
• Implement input validation at the application level (file type, size, content checks).
• Use a WAF to filter malicious uploads.

Workaround:

• If the overlay feature is critical, limit access to trusted IPs only.

Valters IT