Directory traversal in Argus Surveillance DVR (CVE-2018-13388)

Argus Surveillance DVR 4.0.0.0 exposes a web server (usually on 8080) with a WEBACCOUNT.CGI endpoint that does not sanitize the RESULTPAGE parameter. With a string of ..%2F you escape the web directory and read any file on disk with the service's privileges (CVE-2018-13388): a classic directory traversal, unauthenticated.

curl "http://<ip>:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD="

The real value isn't system.ini but files that let you pivot: an SSH private key (/Users/<user>/.ssh/id_rsa) if SSH is present, configuration files with credentials (secrets in source), or Argus's own DVRParams.ini, which stores the administrator password with a reversible cipher.

Nuances. It's a read, not an execution: it chains with whatever you find (SSH, credentials). Being Windows, enumerate first which users exist (Argus's own interface leaks them) so you know which profile paths to read. The number of ..%2F must be enough to reach the drive root.

How to detect it. The attack lives in the web server's access log: unauthenticated requests to WEBACCOUNT.CGI with the RESULTPAGE parameter containing repeated ..%2F and absolute Windows paths (Windows/system.ini, /.ssh/id_rsa, DVRParams.ini). One source trying different ..%2F depths or reading several system files in seconds gives away the sweep, and any WAF flags the encoded traversal. Reading DVRParams.ini or private keys is the highest-severity signal.

Defence. Update or retire Argus Surveillance DVR (unsupported software); don't expose its panel to the network; and, as a principle, normalize and validate server-side any path coming from a parameter before opening the file.