How to remediate – ONVIF Camera Snapshot

1. Introduction

The ONVIF Camera Snapshot vulnerability allows unauthenticated users to view images from remote cameras. This is because the service doesn’t require a username and password to access snapshots. It affects businesses by exposing potentially sensitive video feeds, impacting confidentiality. Systems commonly affected are IP security cameras that support the ONVIF standard. Impact on confidentiality is likely.

2. Technical Explanation

The vulnerability occurs because the camera’s ONVIF interface allows access to snapshots without authentication. An attacker can send specific requests to retrieve images directly from the camera. Nessus identified this by successfully obtaining a snapshot using standard ONVIF commands. There is no known CVE associated with this general issue, but it relates to insecure default configurations within the ONVIF protocol.

• Root cause: Missing authentication for accessing camera snapshots via the ONVIF interface.
• Exploit mechanism: An attacker sends GetProfiles and GetSnapshotUri requests to the camera’s ONVIF port (typically 80 or 443) without providing credentials, successfully retrieving an image. For example, a simple HTTP GET request can retrieve the snapshot URI.
• Scope: IP security cameras supporting the ONVIF standard are affected. Specific models and firmware versions depend on vendor implementation.

3. Detection and Assessment

Confirming vulnerability involves checking for unauthenticated access to snapshots. A quick check is to attempt accessing a default snapshot URL. More thorough assessment can be done with network scanning tools.

• Quick checks: Try accessing the camera’s web interface and look for an ONVIF-related path, such as http:///onvif/getsnapshot or similar.
• Scanning: Nessus vulnerability ID 168745 can identify this issue. Other scanners may have similar checks.
• Logs and evidence: Camera logs might show successful requests for snapshot URIs from unknown sources. Check for activity on port 80 or 443.

curl http:///onvif/getsnapshot

4. Solution / Remediation Steps

Fixing this requires either enabling authentication, filtering access by IP address, or disabling the ONVIF interface if it isn’t needed.

4.1 Preparation

• Ensure you have administrative access to the camera’s web interface. Changes require a planned maintenance window.

4.2 Implementation

1. Step 1: Log in to the camera’s web interface as an administrator.
2. Step 2: Navigate to the ONVIF settings section (location varies by vendor).
3. Step 3: Enable authentication for ONVIF access, setting a strong username and password.
4. Step 4: If authentication isn’t possible or desired, restrict access to the ONVIF port (80/443) using firewall rules to only trusted IP addresses.
5. Step 5: If ONVIF is not required, disable it completely within the camera’s settings.

4.3 Config or Code Example

Before

ONVIF Authentication: Disabled

After

ONVIF Authentication: Enabled Username: admin Password: 

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue.

• Practice 1: Least privilege – limit access to sensitive services like ONVIF only to those who need it.
• Practice 2: Secure defaults – ensure cameras are not shipped with default credentials or open interfaces.

4.5 Automation (Optional)

Automation is unlikely for this specific issue due to the variety of camera vendors and interfaces.

5. Verification / Validation

Confirming the fix involves verifying that authentication is now required or access is restricted.

• Post-fix check: Attempt accessing the snapshot URL again (http:///onvif/getsnapshot). You should receive an authentication prompt.
• Re-test: Re-run the Nessus scan; it should no longer report the vulnerability.
• Monitoring: Check camera logs for failed login attempts on the ONVIF interface, which could indicate brute force attacks.

curl -u admin: http:///onvif/getsnapshot

6. Preventive Measures and Monitoring

Preventive measures include updating security baselines and reviewing camera configurations regularly.

• Baselines: Update your security baseline to require authentication for all ONVIF cameras.
• Pipelines: Include configuration checks in deployment pipelines to ensure secure defaults are applied.
• Asset and patch process: Review camera firmware updates regularly, as vendors may release fixes for known vulnerabilities.

7. Risks, Side Effects, and Roll Back

Enabling authentication could cause compatibility issues with older systems that don’t support it. Disabling ONVIF might break integration with other security platforms.

• Risk or side effect 2: Loss of functionality if ONVIF is disabled. Mitigation is to ensure alternative methods are available for accessing camera features.
• Roll back: Restore the original configuration file from your backup. If firewall rules were changed, revert them.

8. References and Resources

Links to relevant resources.

• Vendor advisory or bulletin: Check your camera vendor’s website for specific advisories.
• NVD or CVE entry: No specific CVE is associated with this general issue, but search NVD for ONVIF vulnerabilities.
• Product or platform documentation relevant to the fix: Refer to your camera’s user manual for instructions on configuring authentication and firewall rules.