JVC VN-T IP Cameras Directory Traversal Vulnerability Allowing Arbitrary File Read

A directory traversal vulnerability has been identified in JVC VN-T IP camera models, specifically in the VN-T216VPRU model, running firmware versions prior to 2016-08-22. The vulnerability exists in the 'check.cgi' endpoint, which accepts a user-controlled file parameter. This flaw allows an unauthenticated remote attacker to read arbitrary files from the device.

Impact

Exploitation of this vulnerability leads to local file disclosure, allowing attackers to read sensitive files from the device, such as configuration files containing credentials.

Reproduction

To reproduce this vulnerability, send a request to the 'check.cgi' endpoint with a crafted file parameter that includes directory traversal sequences. This can be done by replacing 'host' and 'port' with the target camera's address and the appropriate port number. The response will include the contents of the requested file, demonstrating the successful exploitation of the directory traversal vulnerability.