CVE-2020-11679

Vulnerability

Castel NextGen DVR v1.0.0 contains an authorization bypass vulnerability in the Adminstrator/Users/Edit/:UserId endpoint. The endpoint fails to verify that the request originates from an Administrator user, allowing requests from lower-privileged users to be processed [1]. This occurs because the application only hides administrative functions from the interface (e.g., CSS/HTML hiding of links) without enforcing server-side access controls [1]. The vulnerability is present in version v1.0.0.

Exploitation

An attacker with a valid low-privileged account (e.g., a Reviewer role) can directly navigate to the Adminstrator/Users/Edit/:UserId endpoint via a web browser or craft a request using tools like a proxy. By accessing the edit page for their own user ID and submitting a form that adds administrator roles (e.g., via POST or PUT), the attacker escalates their privileges without requiring any additional authentication or interaction from an administrator [1]. The exploit relies on the lack of server-side authorization checks; knowledge of the URL pattern is sufficient.

Impact

Successful exploitation allows a normal user to add administrative roles to their account, resulting in full administrator privileges within the Castel NextGen DVR system [1]. This leads to complete compromise of the application's confidentiality, integrity, and availability, as the attacker can access all data, modify configurations, and potentially disrupt operations.

Mitigation

As of the publication date (2020-06-04), no official patch has been released for v1.0.0 [1]. The vendor, Castel, should implement server-side authorization checks on the Adminstrator/Users/Edit/:UserId endpoint to verify that the requesting user holds an Administrator role before processing changes. As a workaround, organizations can restrict network access to the DVR management interface or implement additional monitoring for unauthorized privilege escalation attempts. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.