## Summary
GeoWebPlayer (a.k.a. “Web Plugin” / “WS Player”) contains multiple out-of-bounds read vulnerabilities in its Websocket Server. A specially crafted websocket message can lead to arbitrary code execution; Talos notes an attacker can stage a malicious webpage to trigger the issue.
## Technical Details
- The Websocket server accepts commands from localhost and parses JSON fields such as index.
- For the connectInfo command, the index value is extracted from the websocket message:
- entry = get_entry(json_root, "index");
- index = json_value_to_int(&v3->value);
- The index is then passed to GeoWebPlayer_cam_connect(index, conn_details);.
- Insufficient validation allows index to be out of range, which can result in out-of-bounds access to arrays (including cases that can lead to out-of-bound writes depending on code flow), e.g.:
- viewer->array_of_IPCams[index]->field_FC = 0;
- sub_405760(&viewer->array_of_IPCams[index]->field_94, &conn_details.conn_details.probably_title_str);
- Talos reports that the overall issue set can be exploited to reach arbitrary code execution.
## Affected
- GeoWebPlayer version 1.1.1.0
## Impact
- Arbitrary code execution via crafted websocket messages.
- Memory corruption risk due to CWE-129 (improper validation of array index), with potential out-of-bounds reads/writes.
## Mitigation
1. Update GeoWebPlayer to the latest patched version available via GeoVision’s product download page (referenced by GeoVision as the place where security patches are provided).
2. If updates are not immediately possible, restrict access to the Websocket server so that only trusted local processes can reach it (Talos describes command acceptance from localhost).
3. Monitor for anomalous websocket traffic/command patterns involving the connectInfo command and unexpected index values.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-129