PT-2018-18893 · Axis+1 · Axis P1354+1
Published
2018-04-01
·
Updated
2024-08-05
·
CVE-2018-9156
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
AXIS P1354 (IP camera) Firmware version 5.90.1.1
Description
An issue was discovered where the upload web page does not verify the file type, allowing an attacker to upload a webshell by making a fileUpload.shtml request for a custom .shtml file. This file is interpreted by the Apache HTTP Server mod include module, which supports the execution of system commands using the "<!--#exec cmd=" syntax. The uploaded file must include a specific string to align with the internal system architecture. After uploading the webshell, an attacker can use it to perform remote code execution, such as running system commands.
Recommendations
For AXIS P1354 (IP camera) Firmware version 5.90.1.1, consider restricting access to the file upload feature to minimize the risk of exploitation, as the vendor reportedly indicates this is an intended feature or functionality. However, since this could potentially allow for remote code execution, it is crucial to monitor the device's security and apply any future patches that may address this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Axis P1354
Apache Http Server