UniView Media Server CORS Hardening: Enabling Strict Validation to Prevent Unauthorized Cross-Origin Session Access

Vulnerability Overview This page primarily introduces how to enable CORS (Cross-Origin Resource Sharing) validation to enhance the security of the Media Server. By default, the Media Server uses a standard security level that allows cross-origin resource sharing but disables strict CORS validation. Enabling strict CORS validation prevents malicious web pages from accessing session data that authenticated users may have access to. Scope of Impact Standard (Default): The server reflects any header, ensuring compatibility with all integrations, but strict CORS protection is disabled. High (Strict): Validates the header to prevent unauthorized cross-origin session access, though this may impact certain third-party integrations. Remediation New Installations 1. Via WebAdmin: During the "Configure New Site" process, select "Advanced Site Settings" and set the security level dropdown to "High". 2. Via Desktop Client: In the "Start" dialog, select "Advanced System Settings" and set the security level to "High". Existing Installations (API Method) 1. WebAdmin Method: - Navigate to the hidden advanced settings in WebAdmin: - Scroll down to locate the HTTP header: setting. - Enter to enable strict CORS validation, or enter to disable strict CORS validation. 2. REST API Method: - Enable Strict CORS Validation: - Disable Strict CORS Validation (Restore): Verification 1. Open the WebAdmin page. 2. Open Developer Tools: Press F12 (or Ctrl+Shift+I) and select the "Network" tab. 3. Refresh the WebAdmin page. 4. Inspect the requests: For example, check the page request. 5. Check the response headers: Go to the "Headers" (or "Response") sub-tab and locate . Compatibility Considerations Audit Integrations: Identify any web-based dashboards or embedded clients that call APIs from different domains. Test in Staging Environment: Ensure that legitimate cross-origin requests are not blocked. Explicit Allowlist: If specific trusted domains need access, contact your administrator to configure specific origins rather than using . Related Resources Controlling Uniview Camera White Light via HTTP(S) Requests Understanding Remote Access Tool (RAT) Configuration How to Change Software Log Levels and Obtain Logs Integrating WiserRoadAI with VMS Accessing Nx Witness User Manual Comments Comments on this article are closed. Summary Enabling strict CORS validation can significantly improve the security of the Media Server by preventing unauthorized cross-origin session access. Both new and existing installations can be configured via WebAdmin or the REST API. Before applying changes, it is recommended to consider compatibility and perform testing to ensure existing integrations and functionalities are not disrupted.

Goal Reached Thanks to every supporter — we hit 100%!

UniView Media Server CORS Hardening: Enabling Strict Validation to Prevent Unauthorized Cross-Origin Session Access