Itel Electronics IP Stream WebSocket Vulnerability Allowing Unauthorized Command Execution with Administrator Privileges

A broken access control vulnerability has been identified in Itel Electronics IP Stream version 1.7.0.6. This issue allows unauthorized attackers to execute arbitrary commands with Administrator privileges through the WebSocket API. Once a legitimate user is logged in, an attacker can send commands to manipulate stream settings, change configurations, and potentially disrupt broadcasting services.

Impact

Exploitation of this vulnerability could lead to unauthorized access to administrative functions, allowing attackers to alter stream settings and configurations, disrupt broadcasting services, and manipulate user credentials, potentially locking out legitimate users.

Reproduction

To reproduce this vulnerability, log into the Itel IP Stream web interface as a legitimate user. Then, connect to the WebSocket endpoint using a WebSocket client. Once connected, send commands to the WebSocket backend to manipulate stream settings and configurations without proper authorization.

Remediation

It is recommended to implement token-based authentication for all WebSocket requests, validate each request against an active user session, restrict WebSocket access to authorized users only, and enhance logging and monitoring of WebSocket requests for auditing and anomaly detection.