Attack Chain

1. Attacker performs reconnaissance to identify internet-facing C-MOR Video Surveillance instances.
2. Attacker crafts a malicious HTTP GET request targeting the 'show-movies.pml' endpoint.
3. Attacker injects directory traversal sequences (../) into the 'cam' parameter within the URL query string.
4. The vulnerable web application processes the request without sanitizing the input path.
5. The server-side code resolves the path relative to the root directory or unintended application directories.
6. The application returns the contents of the requested file (e.g., /etc/passwd) in the HTTP response body.
7. Attacker parses the response to exfiltrate system configuration or sensitive data.

Impact

Successful exploitation allows unauthenticated remote attackers to retrieve arbitrary files from the filesystem of the C-MOR surveillance server. This can lead to the exposure of sensitive configuration files, system credentials, or other internal application data. The scope of impact is limited to the server running the vulnerable software, but potentially provides attackers with sufficient information to elevate privileges or pivot further into the internal network.

Recommendation

1. Patch C-MOR Video Surveillance to the latest version immediately if a fix is provided by za-internet GmbH; if no patch is available, restrict access to the web interface via network controls.
2. Deploy the provided Sigma rule to detect attempts to access sensitive system files via the show-movies.pml component.
3. Monitor web server access logs for anomalous requests containing directory traversal sequences (e.g., ../) directed at the show-movies.pml script.