CVE-2023-6895: Hikvision Intercom RCE Vulnerability

CVE-2023-6895 Overview

A critical OS command injection vulnerability has been identified in the Hikvision Intercom Broadcasting System version 3.0.3_20201113_RELEASE(HIK). This vulnerability exists in the /php/ping.php file and allows remote attackers to execute arbitrary operating system commands through manipulation of the jsondata[ip] parameter. The exploit has been publicly disclosed and can be triggered by injecting system commands such as netstat -ano into the vulnerable parameter, enabling complete system compromise without authentication.

Critical Impact

Unauthenticated remote attackers can achieve complete system compromise by executing arbitrary OS commands on vulnerable Hikvision intercom devices, potentially leading to network reconnaissance, lateral movement, and full device takeover.

Affected Products

• Hikvision Intercom Broadcast System (version 3.0.3_20201113_RELEASE and earlier)
• Hikvision DS-KD Series Door Stations (DS-KD-BK, DS-KD-DIS, DS-KD-E, DS-KD-IN, DS-KD-INFO, DS-KD-KK, DS-KD-KP, DS-KD-M, DS-KD3003-E6, DS-KD8003IME1)
• Hikvision DS-KH Series Indoor Stations (DS-KH6220-LE1, DS-KH6320 series, DS-KH6350-WTE1, DS-KH6351 series, DS-KH8520-WTE1, DS-KH9310-WTE1, DS-KH9510-WTE1)

Discovery Timeline

• December 17, 2023 - CVE-2023-6895 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-6895

Vulnerability Analysis

This command injection vulnerability (CWE-78) affects the ping functionality within the Hikvision Intercom Broadcasting System's web interface. The vulnerable endpoint /php/ping.php accepts user-controlled input through the jsondata[ip] parameter without proper sanitization or validation. When the application processes this input, it directly incorporates the parameter value into a system command execution context, allowing attackers to append or inject arbitrary shell commands.

The vulnerability is particularly dangerous because it requires no authentication to exploit and can be triggered remotely over the network. An attacker can leverage this flaw to execute reconnaissance commands like netstat -ano to enumerate network connections, or more destructive commands to establish persistent access, exfiltrate data, or pivot to other systems on the network.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the PHP code handling the ping functionality. The application fails to properly escape or filter user-supplied input before passing it to shell execution functions. Instead of validating that the jsondata[ip] parameter contains only a valid IP address or hostname, the application passes the raw input directly to the underlying operating system command, creating a classic command injection scenario.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker can craft a malicious HTTP request to the /php/ping.php endpoint, injecting OS commands through the jsondata[ip] parameter. By using shell metacharacters such as semicolons, pipes, or command substitution syntax, the attacker can chain arbitrary commands to the legitimate ping operation.

For example, by providing an input like 127.0.0.1; netstat -ano or utilizing other shell escape techniques, the attacker can execute arbitrary system commands with the privileges of the web server process. This typically grants significant access to the underlying system, potentially including the ability to read sensitive files, modify configurations, or establish reverse shells for persistent access.

Technical details and exploitation methodology can be found in the GitHub Remote Code Execution Guide and VulDB advisory #248254.

Detection Methods for CVE-2023-6895

Indicators of Compromise

• Unusual HTTP POST requests to /php/ping.php containing shell metacharacters (;, |, &, $(), backticks) in the jsondata[ip] parameter
• Unexpected outbound network connections from Hikvision intercom devices, particularly reverse shell connections
• Evidence of reconnaissance commands being executed (e.g., netstat, whoami, id, uname) in system logs
• Unauthorized processes spawned by the web server or PHP process on affected devices

Detection Strategies

• Implement network-based intrusion detection rules to monitor HTTP traffic to /php/ping.php for command injection patterns
• Deploy web application firewall (WAF) rules to block requests containing shell metacharacters in JSON parameters
• Monitor network traffic from intercom devices for anomalous outbound connections or data exfiltration attempts
• Analyze web server access logs for suspicious requests targeting the vulnerable ping endpoint

Monitoring Recommendations

• Enable comprehensive logging on Hikvision devices and forward logs to a centralized SIEM for analysis
• Configure network segmentation to isolate IoT and intercom devices from critical infrastructure
• Implement behavioral monitoring to detect unusual process execution patterns on embedded devices
• Set up alerts for any network communication from intercom devices to unexpected external IP addresses

How to Mitigate CVE-2023-6895

Immediate Actions Required

• Upgrade all affected Hikvision Intercom Broadcasting System devices to version 4.1.0 or later immediately
• If immediate patching is not possible, restrict network access to the device management interfaces using firewall rules
• Implement network segmentation to isolate affected devices from critical network infrastructure
• Monitor affected devices for signs of compromise while planning the upgrade

Patch Information

Hikvision has addressed this vulnerability in version 4.1.0 of the Intercom Broadcasting System firmware. Organizations should upgrade all affected devices to this version or later to remediate the command injection vulnerability. Contact Hikvision support or visit the official Hikvision security portal for firmware downloads and upgrade instructions for the various affected DS-KD and DS-KH series devices.

Workarounds

• Block external network access to the /php/ping.php endpoint using firewall rules or access control lists
• Place affected devices behind a reverse proxy with WAF capabilities to filter malicious requests
• Disable or restrict access to the web management interface until patches can be applied
• Implement strict network access controls to allow only authorized management stations to communicate with affected devices

# Example iptables rules to restrict access to affected devices
# Replace 192.168.1.100 with the IP of your Hikvision device
# Replace 192.168.1.0/24 with your trusted management network

# Block all HTTP/HTTPS access to the device
iptables -A INPUT -d 192.168.1.100 -p tcp --dport 80 -j DROP
iptables -A INPUT -d 192.168.1.100 -p tcp --dport 443 -j DROP

# Allow only trusted management network
iptables -I INPUT -s 192.168.1.0/24 -d 192.168.1.100 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 192.168.1.0/24 -d 192.168.1.100 -p tcp --dport 443 -j ACCEPT