CVE-2018-7467 Scanner

AxxonSoft Axxon Next is a video management software (VMS) system designed for organizations to manage and monitor their video surveillance systems. This software is used by commercial enterprises, educational institutions, government agencies, and other industries where video surveillance is required. The Axxon Next provides comprehensive video management capabilities, including live video feeds, video playback, video analysis, and multiple viewing modes. Moreover, this product allows organizations to easily manage cameras, view footage, and monitor footage across multiple locations from a single platform.

The vulnerability CVE-2018-7467 is a directory traversal flaw that arises due to insufficient input validation in the handling of URI paths. Specifically, the software fails to properly sanitize user-supplied input containing directory traversal sequences like ../. This allows an attacker to manipulate the URI to navigate outside the intended web root directory and access sensitive files on the server. The vulnerability is present in Axxon Next versions 4.1.1.6408 and earlier.

Technically, the vulnerability is triggered by sending a crafted HTTP request to the Axxon Next server with a URI containing an initial /css//..%2f substring. The double slash and URL-encoded traversal sequence bypass weak filters, enabling the attacker to traverse directories. For example, a request like /css//..%2f..%2f..%2fetc/passwd could retrieve the system password file. This endpoint is typically used for serving static CSS files, but the flawed path handling exposes it to exploitation.

If exploited, an attacker can read arbitrary files from the server, including configuration files, credentials, and sensitive surveillance data. This could lead to full system compromise, unauthorized access to video feeds, and potential data breaches. Given the critical nature of video surveillance systems in security operations, such an exploit can have severe consequences for organizational safety and privacy.