NUUO Crystal Server Remote Code Execution Scanner

NUUO Crystal Server is a video management solution often used in surveillance systems for monitoring and recording video feeds. It is deployed by businesses, educational institutions, and security agencies to manage CCTV network infrastructures efficiently. The software allows for centralized management and control of multiple camera feeds, proving vital in areas requiring rigorous security protocols. Its features enhance surveillance capabilities by providing a reliable platform for storing, analyzing, and retrieving video data. It is valued for its scalability, meeting the varying security demands of both small and large enterprises. Users rely on its robust architecture to ensure round-the-clock surveillance operations.

The Remote Code Execution (RCE) vulnerability in this system is critical, allowing attackers to execute arbitrary code within the server environment. Such vulnerabilities are often exploited when proper validation or security measures are lacking. RCE can lead to a full compromise of the server, allowing attackers unauthorized access to sensitive operations. Generally, RCE exploits are severe because they can propagate malware, manipulate server operations, or extract confidential information. Exploiters can manipulate and control the server if the vulnerability remains unpatched. Businesses must prioritize resolving such vulnerabilities promptly to mitigate potential damages.

The technical details involve exploiting the upload.php endpoint exposed in NUUO Crystal Server version 3.19.0.85, where there lacks authentication and content validation. Attackers can send a crafted POST request containing a malicious PHP file via this endpoint. Once uploaded, the file can be accessed and executed by making a GET request to the server. The server's insufficient mechanism for validating the upload parameters such as filename or extension makes this operation possible. This bypass in security checks allows malicious code to run with the same privileges as the PHP service account. Successful exploitation results in remote code execution and allows full control over the server.

If successfully exploited, the vulnerability could result in a complete system compromise, data breach, and unauthorized operations. Attackers could upload malicious files, execute them remotely, and take over surveillance management functionalities. The consequences extend to data loss, integrity compromise, and a potential pivot within the network to launch further attacks. Organizations relying on NUUO Crystal Server could face operational disruptions and financial loss from a breach. Immediate patching and implementing stringent upload validations are imperative to prevent such effects.

REFERENCES

• https://0day-rubbish.com/blog/nuuo-crystal-server-unauth-upload-php-webroot-write-rce
• https://github.com/Exploit-Garbage/0day-Rubbish