Remote session stealing of Hikvision Access Control/Intercom Products

Vulnerability description

Remote attacker can steal valid authentication session ID-s of Hikvision Access Control/Intercom Products. This is possible because a remote attacker can create a session ID-s without restrictions. If an attacker requests a session ID at the same time as a valid user, the attacker receives the identical session ID. This session ID is immediately recognized as valid after successful authentication of the correct user.

The authentication session key generation can be initiated in an API interface and requested without providing password. Therefore anyone can request session ID linked to any user.
The session ID becomes valid after successful authentication by legitimate user with valid username and password. If an attacker and a legitimate user access the API at the same time,
they receive the same session key. If the user's authentication was successful, the session key becomes valid and can also be used by an attacker to authenticate with rights of the legitimate user.

The attack can be simply described by following steps:

1. Attacker initiates connection ISAPI to generate sesstionID

2. The user authenticates and gets sessionID from ISAPI

3. If attacker and user requests key generation from ISAPI at same time, the same sessionID is being generated

4. The attacker uses same sessionID to authenticate

5. The attacker has authenticated access to management web portal and API

Attack topology:

Impact

PoC scripts

ISAPI sessionID generation script:
Download: request_ids.py

Valid session request script:
Download: validate.sh

PoC video:

Download PoC video: video.mp4