CVE-2018-9157: Malicious File Upload
DISPUTED An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server modinclude module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-9157.
What is the affected software?
The affected software is AXIS M1033-W Firmware version 5.40.5.1.
What is the severity of CVE-2018-9157?
The severity of CVE-2018-9157 is high with a score of 7.5.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by uploading a malicious .shtml file using the fileUpload.shtml request.
Is there a fix available for this vulnerability?
There may not be an official fix available as this vulnerability is disputed. It is recommended to contact the vendor for further information.