PT-2022-23818 · Unknown · Patrickfuller Camp

Elias Hohl · Published 2022-11-14 · Updated 2023-03-27 · CVE-2022-37109

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions patrickfuller camp versions up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767

Description The issue concerns Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler. The Tornado rule to throw a 403 error when password.txt is accessed can be bypassed. Furthermore, it is not necessary to crack the password hash to authenticate with the application because the password hash is also used as the cookie secret, so an attacker can generate his own authentication cookie.

Recommendations For versions up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767, consider restricting access to the password.txt file to minimize the risk of exploitation. As a temporary workaround, consider disabling the StaticFileHandler for the root directory until a proper fix is applied. Additionally, avoid using the password hash as the cookie secret to prevent unauthorized authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-37109

Affected Products

Patrickfuller Camp

References · 9

• 🔥 https://github.com/ehtec/camp-exploit · Exploit
• 🔥 https://exploit-db.com/exploits/51041 · Exploit
• 🔥 https://medium.com/@elias.hohl/authentication-bypass-vulnerability-in-camp-a-raspberry-pi-camera-server-477e5d270904 · Exploit
• https://github.com/patrickfuller/camp/commit/bf6af5c2e5cf713e4050c11c52dd4c55e89880b1 · Patch
• https://osv.dev/vulnerability/CVE-2022-37109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37109 · Security Note
• http://packetstormsecurity.com/files/171478/Raspberry-Pi-Camera-Server-1.0-Authentication-Bypass.html · Note
• https://medium.com/%40elias.hohl/authentication-bypass-vulnerability-in-camp-a-raspberry-pi-camera-server-477e5d270904 · Note
• https://t.me/cvenotify/37683 · Telegram Post