GeoVision GV-ASWeb Broken Access Control Vulnerability Allowing Privilege Escalation

A broken access control vulnerability has been identified in GeoVision GV-ASWeb versions through 6.1.0.0. This vulnerability enables low-privilege users to perform unauthorized actions, which can be exploited to escalate privileges and manage user accounts. Specifically, affected users can create, modify, or delete accounts, and manipulate access controls.

Impact

Exploitation of this vulnerability allows low-privilege users to gain administrative rights, after which they can access and control various resources and services, including monitoring cameras and managing access control data. Additionally, this vulnerability can be exploited to remove legitimate administrator accounts.

Reproduction

To reproduce this vulnerability, log into the GeoVision GV-ASWeb application using a low-privilege account, such as the default Guest account. Once logged in, unauthorized actions can be performed, such as creating a new user account or modifying the privileges of existing accounts. After establishing a new account, privileges can be escalated to Administrator by manipulating account levels. This process can be automated to streamline the exploitation.

Remediation

GeoVision has released a patch for this vulnerability in version 6.1.2.0. Users can download the latest version from the GeoVision website.