Authenticated Arbitrary File Upload in Agent DVR

Agent DVR version 5.1.6.0 contains a vulnerability (CVE-2024-22515) involving an authenticated arbitrary file upload. The vulnerability stems from insufficient validation of file types within the application's audio upload component. A user with low-level privileges can bypass the file type restriction by selecting any file type during the upload process. When chained with other techniques, this flaw allows attackers to upload arbitrary files to the server and potentially execute code on the host system. The vulnerability has been confirmed by public exploit proofs of concept, necessitating immediate patching to version 5.1.7.0 or later.

Impact

Successful exploitation allows an authenticated attacker with low privileges to upload malicious files to the underlying host. If the application is running with elevated permissions, or if the uploaded files can be executed through other application features, this facilitates remote code execution (RCE). This impacts the confidentiality, integrity, and availability of the host running Agent DVR.

Recommendation

• Update all instances of Agent DVR to version 5.1.7.0 or later immediately to address the missing file type validation in the audio upload component.
• Review web server access logs for anomalous POST requests directed toward audio upload endpoints by low-privileged user accounts.
• Implement strict file type filtering at the web application firewall (WAF) level to prevent the upload of non-audio file formats if patching is delayed.