id: mobotix-default-credentials

info:
  name: Mobotix - Default Login
  author: robotshell
  severity: high
  description: Mobotix contains a default admin login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://www.mobotix.com/sites/default/files/2020-01/mx_RM_CameraSoftwareManual_en_200131.pdf
  classification:
    cwe-id: CWE-798
    cpe: cpe:2.3:h:mobotix:s14:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    shodan-query: title:"Mobotix"
    product: s14
    vendor: mobotix
  tags: mobotix,default-login,webcam,iot

http:
  - raw:
      - |
        GET /control/userimage.html HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /control/userimage.html HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic YWRtaW46bWVpbnNt

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "!contains(body_1, 'Admin Menu')"
          - "contains(body_2, 'Admin Menu') || contains(body_2, 'Setup Menu') || contains(body_2, 'Audio on')"
        condition: and

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100db607f2fa92b317fedbee2cb2ed245dfc4e8e9c6478659c983e2500bcecd8c0c022029905b3a85ad1de32727133bf625a588bae97c12a288628fe013679626d1ffb6:922c64590222798bb761d5b6d8e72950