← Advisories

Teradek VidiU Pro 3.0.3 CSRF Change Password Exploit

Medium
Advisory ID
ZSL-2018-5460
Release Date
21 May 2018
Vendor
Affected Version
VidiU, VidiU Mini, VidiU Pro, 3.0.3 (build 32136), 3.0.2 (build 31225), 2.4.10
Tested On
lighttpd/1.4.48, lighttpd/1.4.31
Summary

The Teradek VidiU gives you the freedom to broadcast live high definition video directly to the Web without a PC. Whether you're streaming out of a video switcher or wirelessly from your camera, VidiU allows you to go live when you want, where you want. VidiU offers API level integration with the Ustream, YouTube Live and Livestream platforms, which makes streaming to your channel as easy as logging into your account.

Description

The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

Proof of Concept
Disclosure Timeline
02.03.2018Vulnerability discovered.
08.05.2018Vendor contacted.
08.05.2018Vendor replied asking more details.
08.05.2018Sent details to the vendor.
10.05.2018Asked vendor for status update.
13.05.2018No response from the vendor.
14.05.2018Asked vendor for status update.
20.05.2018No response from the vendor.
21.05.2018Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
21.05.2018Initial release
29.05.2018Added reference [1], [2], [3] and [4]
23.03.2026Added reference [5]