GeoWebPlayer (also called “Web Plugin” in the GV-VMS documentation and “WS Player” for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, …). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.<\/p>\n
The Websocket server can accept various commands coming from localhost. Many of the commands will take an `index` value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the `index` value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.<\/p>\n
### saveVideo command index-out-of-bound<\/p>\n
When sending the `saveVideo` command, the `index` field is extracted from the websocket message [1]. Then without checking the range of the index, it is used to trigger a CriticalSection ([2]) and releases it [3]. The release function call ([3]) is executed using a function pointer which will be read out of bounds potentially leading to code execution:<\/p>\n
v6 = get_entry(a2, “index”);<\/p>\n
result = json_is_value_int(v6);<\/p>\n
if ( (_BYTE)result )<\/p>\n
{<\/p>\n
v8 = get_entry(a2, “index”);<\/p>\n
index = json_value_to_int(&v8->value); \/\/ [1]<\/p>\n
result = CCriticalSection::EnterCritSection(&this->crit_sections[index]); \/\/[2]<\/p>\n
if ( result )<\/p>\n
{<\/p>\n
if ( this->array_of_IPCams[index] )<\/p>\n
{<\/p>\n
if ( this->array_of_IPCams[index]->field_20 )<\/p>\n
do_PostMessageA((CViewer *)this->array_of_IPCams[index], 0x111u, 0x139Fu, v11);<\/p>\n
}<\/p>\n
return (*(int (__thiscall **)(CCriticalSection *))(this->crit_sections[index].vtbl + 20))(&this->crit_sections[index]); \/\/[3]<\/p>\n
}<\/p>\n
}<\/p>\n","protected":false},"excerpt":{"rendered":"
GeoWebPlayer (also called “Web Plugin” in the GV-VMS documentation and “WS Player” for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, …). It creates <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12600","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12600","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12600"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}