ID:1839 - Exploit for Authorization bypass in Axis Communications video cameras - CVE-2018-10661

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to bypass authorization on the target system.

The weakness exists in mod_authz_axisgroupfile.so: a custom authorization module for Apache httpd that was written by the vendor due to insufficient validation of user-supplied input. A remote attacker can send unauthenticated requests to a world-readable file that are followed by a backslash and end with the .srv extension that are treated by the authorization code as standard requests to the index.html and thus granted access and bypass the web-server’s authorization mechanism.

Remediation