_ _ _ _ | | | | | | ___ _ ____ _____| | | | __ _| |__ ___ / _ \| '__\ \ /\ / / _ \ | | |/ _` | '_ \/ __| 6079 Smith W | (_) | | \ V V / __/ | | | (_| | |_) \__ \ doubleplusungood \___/|_| \_/\_/ \___|_|_|_|\__,_|_.__/|___/ owning some telescreens... Security Adivisory 2016-04-09 www.orwelllabs.com twt:@orwelllabs I. ADVISORY INFORMATION ----------------------- Title: Axis Network Cameras Multiple Cross-site scripting Vendor: Axis Communications Class: Improper Input Validation [CWE-20] CVE Name: CVE-2015-8256 Remotely Exploitable: Yes Locally Exploitable: No OLSA-ID: OLSA-2015-8256 Adivisory URL: http://www.orwelllabs.com/2016/01/axis-network-cameras-multiple-cross.html II. Background -------------- Axis is the market leader in network video, invented the world’s first network camera back in 1996 and we’ve been innovators in video surveillance ever since. Axis network video products are installed in public places and areas such as retail chains, airports, trains, motorways, universities, prisons, casinos and banks. III. vulnerability ------------------ AXIS Network Cameras are prone to multiple (stored/reflected) cross-site scripting vulnerability. IV. technical details --------------------- These attack vectors allow you to execute an arbitrary javascript code in the user browser (session) with this steps: # 1 Attacker injects a javascript payload in the vulnerable page: http://{axishost}/axis-cgi/vaconfig.cgi?action=get&name= * A reflected cross-site scripting affects all models of AXIS devices on the same parameter: http:// {axis-cam-model}/view/view.shtml?imagePath=0WLL