Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information

Title: Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information
Advisory ID: ZSL-2017-5420
Type: Local/Remote
Impact: Exposure of Sensitive Information, Security Bypass
Risk: (3/5)
Release Date: 10.07.2017
Summary
VideoXpert is a video management solution designed for scalability, fitting the needs surveillance operations of any size. VideoXpert Ultimate can also aggregate other VideoXpert systems, tying multiple video management systems into a single interface.
Description
The software transmits sensitive data using double Base64 encoding for the Cookie 'auth_token' in a communication channel that can be sniffed by unauthorized actors or arbitrarely be read from the vxcore log file directly using directory traversal attack resulting in authentication bypass / session hijacking.
Vendor
Schneider Electric SE - https://www.pelco.com
Affected Version
2.0.41
1.14.7
1.12.105
Tested On
Microsoft Windows 7 Professional SP1 (EN)
Vendor Status
[05.04.2017] Vulnerabilities discovered.
[28.04.2017] Vendor contacted.
[09.07.2017] No response from the vendor.
[10.07.2017] Public security advisory released.
PoC
pelcovideoxpert_cookie.txt
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5419.php
[2] https://www.exploit-db.com/exploits/42312/
[3] https://cxsecurity.com/issue/WLB-2017070079
[4] https://packetstormsecurity.com/files/143318
[5] https://exchange.xforce.ibmcloud.com/vulnerabilities/129664
Changelog
[10.07.2017] - Initial release
[01.08.2017] - Added reference [2], [3] and [4]
[07.08.2017] - Added reference [5]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk