Axis 700 Authentication Bypass Vulnerability
BID:971
Info
Axis 700 Authentication Bypass Vulnerability
| Bugtraq ID: | 971 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 07 2000 12:00AM |
| Updated: | Feb 07 2000 12:00AM |
| Credit: | Posted to Bugtraq by Ian Vitek <[email protected]> on February 7, 2000. |
| Vulnerable: |
Axis Communications Axis 700 Network Document Server 1.14 Axis Communications Axis 700 Network Document Server 1.13 Axis Communications Axis 700 Network Document Server 1.12 Axis Communications Axis 700 Network Document Server 1.11 Axis Communications Axis 700 Network Document Server 1.10 Axis Communications Axis 700 Network Document Server 1.0 |
| Not Vulnerable: |
Axis Communications Axis 700 Network Document Server 1.15 |
Discussion
Axis 700 Authentication Bypass Vulnerability
The Axis 700 Network Scan Server includes a small webserver for administration and monitoring purposes. There is password protection available for the administrator pages, but this can be easily bypassed. The Axis 700 checks the requested URL for permissions before final URL conversion, so using a URL like target/nonrestricted/../restricted/ will let anyone into a restricted directory. Also, character substitution will accomplish the same thing, ie replacing any character in the URL with it's %-escaped equivalent.
The Axis 700 Network Scan Server includes a small webserver for administration and monitoring purposes. There is password protection available for the administrator pages, but this can be easily bypassed. The Axis 700 checks the requested URL for permissions before final URL conversion, so using a URL like target/nonrestricted/../restricted/ will let anyone into a restricted directory. Also, character substitution will accomplish the same thing, ie replacing any character in the URL with it's %-escaped equivalent.
Exploit / POC
Axis 700 Authentication Bypass Vulnerability
see discussion
see discussion
Solution / Fix
Axis 700 Authentication Bypass Vulnerability
Axis Communications Axis 700 Network Document Server 1.0
Axis Communications Axis 700 Network Document Server 1.10
Axis Communications Axis 700 Network Document Server 1.11
Axis Communications Axis 700 Network Document Server 1.12
Axis Communications Axis 700 Network Document Server 1.13
Axis Communications Axis 700 Network Document Server 1.14
Axis Communications Axis 700 Network Document Server 1.0
-
Axis Communications Axis 700 1.15
http://www.axis.com/ftp/pub_soft/scan_srv/axis700/
Axis Communications Axis 700 Network Document Server 1.10
-
Axis Communications Axis 700 1.15
http://www.axis.com/ftp/pub_soft/scan_srv/axis700/
Axis Communications Axis 700 Network Document Server 1.11
-
Axis Communications Axis 700 1.15
http://www.axis.com/ftp/pub_soft/scan_srv/axis700/
Axis Communications Axis 700 Network Document Server 1.12
-
Axis Communications Axis 700 1.15
http://www.axis.com/ftp/pub_soft/scan_srv/axis700/
Axis Communications Axis 700 Network Document Server 1.13
-
Axis Communications Axis 700 1.15
http://www.axis.com/ftp/pub_soft/scan_srv/axis700/
Axis Communications Axis 700 Network Document Server 1.14
-
Axis Communications Axis 700 1.15
http://www.axis.com/ftp/pub_soft/scan_srv/axis700/
References
Axis 700 Authentication Bypass Vulnerability
References:
References:
- Axis 700 Tech Support Page (Axis Communications)