CVE-2021-47795

Executive Summary

CVE-2021-47795 is a collection of high-severity vulnerabilities residing in GeoVision GeoWebServer version 5.3.3, encompassing Local File Inclusion (LFI), Cross-Site Scripting (XSS), and Remote Code Execution (RCE) vectors. These flaws stem from improper input sanitization in the WebStrings.srf endpoint, allowing remote, unauthenticated attackers to traverse the filesystem and potentially execute arbitrary code. Organizations deploying GeoVision surveillance or video management systems are at immediate risk of system compromise, data exfiltration, and lateral movement within the enterprise network. No CVSS score has been assigned, and the patch status is claimed but unverified, making urgent threat modeling and mitigation critical.

Technical Analysis

The core vulnerability lies within the GeoWebServer component's handling of the WebStrings.srf endpoint. This endpoint is designed to serve localized string resources to the web interface. However, due to insufficient input validation and sanitization, it fails to adequately distinguish between benign resource identifiers and malicious path or parameter constructs.

The vulnerability manifests through multiple, combinable vectors:

1. Local File Inclusion (CWE-98): The WebStrings.srf handler likely uses a filename or resource key from the user-controlled param parameter to construct a server-side file path for inclusion. By injecting path traversal sequences (e.g., ../../../../etc/passwd) into this parameter, an attacker can force the server to read and include arbitrary files from the underlying operating system. This can expose sensitive configuration files, credentials, or source code. In more severe cases, if the included file is user-controllable, this LFI can be escalated to Remote Code Execution.

2. Cross-Site Scripting (CWE-79): The lack of output encoding on data processed by the WebStrings.srf endpoint allows for reflected or stored XSS. An attacker can inject malicious JavaScript payloads into parameters that are subsequently reflected in the server's HTTP response without proper sanitization. This could allow session hijacking, defacement, or redirection of authenticated administrators to malicious sites.

3. Remote Code Execution: While the LFI and XSS are the primary entry points, the improper input sanitation can be chained. The inclusion of user-controlled files via LFI could, for example, allow the loading of a malicious PHP or other scriptable file from the system if an attacker can first place one there (e.g., via log poisoning or file upload). The lack of clear boundaries between these input handling functions raises the risk that unauthenticated RCE is achievable with a carefully crafted request chain.

The attack surface is the GeoWebServer HTTP service, which listens on the network and serves the management and viewing interface. The lack of proper allow-listing or canonicalization of file paths, combined with weak output validation, creates the foundation for this multi-class vulnerability.

Exploitation Scenarios

The exploitation of CVE-2021-47795 follows a logical progression from file disclosure to potential code execution.

Scenario 1: Arbitrary File Read (LFI)

1. Reconnaissance: An attacker uses Shodan or Google dorks (e.g., title:"GeoWebServer" or "Server: GeoWebServer") to identify internet-facing GeoVision systems running version 5.3.3. Network mapping confirms the web service is accessible on port 80 or 443.
2. Weaponization & Trigger: The attacker crafts a GET request to the vulnerable endpoint, manipulating the param parameter to include path traversal sequences. For instance:

   GET /WebStrings.srf?param=../../../../../../etc/passwd HTTP/1.1
   Host: target.com
   

   Alternatively, null-byte or double-encoding techniques (%2e%2e%2f) might be used to bypass basic filters.
3. Execution: The server processes the malformed path, reads the content of /etc/passwd (or C:\Windows\win.ini on Windows), and returns its contents in the HTTP response body.
4. Post-Exploitation: The attacker harvests user accounts, service credentials, or application source code from the response. This information can be used for credential stuffing or to craft subsequent, more targeted attacks, such as locating database connection strings in configuration files (web.config, .env).

Scenario 2: Remote Code Execution (Chained Attack)

1. Reconnaissance: The attacker first uses the LFI to read application source code and logs (e.g., ../../../../../../var/log/apache2/access.log).
2. Weaponization: The attacker sends a malicious request to the server, ensuring the payload (e.g., a PHP one-liner) is written to the access log file. A standard user-agent or URL parameter containing <?php system($_GET['cmd']); ?> is used.
3. Trigger: The attacker then uses the LFI vulnerability again, this time to include the access.log file. The server interprets the PHP code embedded in the log file, executing the attacker's commands.

   GET /WebStrings.srf?param=../../../../../../var/log/apache2/access.log&cmd=id HTTP/1.1
   

4. Execution: The id command is executed on the underlying OS with the privileges of the GeoWebServer process (which often runs with local system or elevated service account privileges).
5. Post-Exploitation: The attacker establishes a reverse shell, escalates privileges, and uses the compromised server as a pivot point to attack other internal systems.

Impact Assessment

Given that no CVSS score has been assigned by the CNA, the risk must be assessed qualitatively. The vulnerability is network-exploitable with low complexity and requires no authentication or user interaction, indicating a critical risk profile. The primary business impact is full system compromise. Since GeoWebServer is typically deployed on security infrastructure, compromise has profound implications for physical security integrity, surveillance footage confidentiality, and data privacy.

• Affected Systems: GeoVision NVRs, DVRs, and servers running GeoWebServer 5.3.3. This includes edge devices and centralized management servers.
• Confidentiality: High — LFI allows arbitrary file read, exposing credentials, encryption keys, PII from video analytics, and internal network topology.
• Integrity: High — RCE enables modification of system files, tampering with recorded video, altering system configurations, and planting persistent backdoors.
• Availability: High — An attacker could disrupt the video surveillance service or use the server as a botnet node. They could also wipe data or cause a denial of service by crashing the service.
• Blast Radius: Compromise of a GeoVision device can lead to lateral movement within the OT (Operational Technology) or IT segmentation, potentially compromising physically secured zones and violating compliance mandates (e.g., GDPR, HIPAA).

Detection Guidance

Detect exploitation attempts by monitoring for path traversal sequences and anomalous web requests targeting the WebStrings.srf endpoint.

Sigma Rule

title: GeoVision GeoWebServer WebStrings.srf Local File Inclusion
status: experimental
description: Detects attempts to exploit LFI in GeoVision GeoWebServer by looking for path traversal patterns in requests to WebStrings.srf.
logsource:
  category: webserver
  product: apache # or iis, nginx depending on deployment
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains:
      - '/WebStrings.srf'
  filter_path_traversal:
    cs-uri-query|contains:
      - '..%2F'
      - '%2e%2e%2f'
      - '..\\'
  filter_etc_passwd:
    cs-uri-query|contains:
      - '/etc/passwd'
      - 'C:\windows'
  condition: selection and (filter_path_traversal or filter_etc_passwd)
level: high
falsepositives:
  - Allowed recursive functions or specific administrative tools (unlikely for typical web traffic).

YARA Rule

rule CVE_2021_47795_GeoWebServer_Traversal
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects both client-side requests and server-side log entries containing path traversal attempts against GeoVision GeoWebServer."
        date = "2024-03-01"
  strings:
    $srf = "WebStrings.srf"
    $traversal_1 = "..%2f"
    $traversal_2 = "..\\"
    $traversal_3 = "../../"
    $etx = "/etc/passwd"
    $win = "win.ini"
  condition:
      $srf and ( 1 of ($traversal*) or 1 of ($etx, $win) )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT GeoVision GeoWebServer LFI Attempt (CVE-2021-47795)";
    flow:to_server,established;
    http.uri;
    content:"/WebStrings.srf";
    urilen:>15;
    pcre:"/[?&]param=(?:\.\.(?:%2f|\/|\\|%5c)){2,}/iU";
    classtype:attempted-user;
    sid:2021401;
    rev:1;
)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [network where event.type == "start" and destination.port in (80, 443) and process.name == "GeoWebServer"]
  [file where event.type == "write" and path contains "access.log"] // log poisoning stage
  [process where event.type == "start" and parent.process.name == "GeoWebServer"] // RCE via inclusion

Splunk SPL Query

index=web sourcetype="access_combined" uri="/WebStrings.srf"
| regex uri="(\.\.%2f|\.\./|\.\.\\\\|%2e%2e%2f)"
| OR regex uri="(etc/passwd|win\.ini)"
| stats count by src_ip, uri, _time
| sort - _time

Wazuh OSSEC Rule

<group name="geovision,">
  <rule id="202141" level="10">
    <if_sid>31100</if_sid> <!-- Check for web log format -->
    <match>WebStrings.srf</match>
    <regex>param=.*(\.\.%2f|\.\./|%2e%2e%2f)</regex>
    <description>GeoVision GeoWebServer (CVE-2021-47795) Path Traversal attempt detected.</description>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

The patch status is CLAIMED (Confidence 2/4) based on a single source; this has not been independently confirmed by the vendor or a second party. Given this uncertainty, immediate operational mitigation is essential.

1. Immediate Mitigations (Now):
   • Restrict access to the GeoWebServer web interface. Place it behind a strict firewall/VPN and ensure it's not directly exposed to the internet. If it must be exposed, use a WAF with rules to block WebStrings.srf requests containing traversal payloads.
   • Disable WebStrings.srf endpoint if not required by application functionality; test the system to ensure no feature breakage.
   • Verify that the GeoWebServer service account has the lowest possible privileges (e.g., not root/SYSTEM) to limit the impact of RCE.
2. Patch/Upgrade Steps (As Soon as Possible):
   • Contact GeoVision technical support or monitor their official portal for a security advisory or patched version of GeoWebServer.
   • Prioritize testing and deployment of the claimed fix. However, treat the patch claim as unverified and conduct a full application and regression test before and after implementation.
   • If no patch is available from the vendor, consider decommissioning the vulnerable component or replacing it with a different solution.
3. Long-Term Hardening:
   • Establish a routine update and vulnerability management lifecycle for all OT/IoT devices.
   • Segment the network to ensure security appliances are isolated.
   • Harden server OS configurations, disable unused modules, and implement strict egress filtering to prevent reverse shells.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-47795 (Note: NVD entry exists but lacks CVSS/CWE data currently).
2. ProjectDiscovery Nuclei Templates Repository: Search for "geovision" (The detection template for this CVE is publicly available here, referencing the WebStrings.srf endpoint).
3. GeoVision Website: https://www.geovision.com.tw/ (Official vendor for support and potential advisories).
4. FIRST.org EPSS (Check for future scoring): https://www.first.org/epss/

Threat Actor Campaign Evidence: No specific threat actor campaigns have been publicly attributed to this CVE as of this report. However, the vulnerability class (LFI/RCE on exposed web interfaces) is a staple of IoT botnet families (e.g., Mirai variants) and APT groups targeting surveillance systems. Given the public availability of a Nuclei detection template, automated scanning and opportunistic exploitation are highly likely. The absence of a known CISA KEV entry does not diminish the risk, as the endpoint is easily discoverable via network scans.