Title: STVS ProVision 5.9.10 (archive.rb) Authenticated File Disclosure Vulnerability
Advisory ID: ZSL-2021-5623
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information
Risk: (3/5)
Release Date: 26.01.2021

Summary

STVS is a Swiss company specializing in development of software for digital video recording for surveillance cameras as well as the establishment of powerful and user-friendly IP video surveillance networks.

Description

The NVR software ProVision suffers from an authenticated arbitrary file disclosure vulnerability. Input passed through the files parameter in archive download script (archive.rb) is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files.

Vendor

STVS SA - http://www.stvs.ch

Affected Version

5.9.10 (build 2885-3a8219a)
5.9.9 (build 2882-7c3b787)
5.9.7 (build 2871-a450938)
5.9.1 (build 2771-1bbed11)
5.9.0 (build 2701-6123026)
5.8.6 (build 2557-84726f7)
5.7
5.6
5.5

Tested On

Ubuntu 14.04.3
nginx/1.12.1
nginx/1.4.6
nginx/1.1.19
nginx/0.7.65
nginx/0.3.61

Vendor Status

[19.01.2021] Vulnerability discovered.
[19.01.2021] Vendor contacted.
[25.01.2021] No response from the vendor.
[26.01.2021] Public security advisory released.

PoC

provision_lfi.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] https://www.exploit-db.com/exploits/49481
[2] https://packetstormsecurity.com/files/161157
[3] https://cxsecurity.com/issue/WLB-2021010190
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/195721

Changelog

[26.01.2021] - Initial release
[31.01.2021] - Added reference [1], [2], [3] and [4]

Contact

Zero Science Lab

Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk