CVE-2024-13985 Scanner

Dahua EIMS, developed by Dahua Technology, is an Emergency Information Management System widely used in government, transportation, and other critical sectors for effective information dissemination and communication management. It facilitates real-time monitoring and response to emergencies, making it a crucial tool in emergency preparedness and crisis management. Security and reliability are of utmost importance in its implementation to ensure timely and accurate information delivery. Organizations make extensive use of Dahua EIMS by integrating it into their existing infrastructure, leveraging its advanced communication capabilities. The platform supports various modules for data recording, video surveillance, and alarm management, aiding in operational efficiency and safety. With its user-friendly interface and scalability, Dahua EIMS is suitable for a wide range of large and small organizational setups that prioritize emergency management.

The vulnerability is a critical Remote Code Execution (RCE) flaw that occurs due to improper input validation in the capture_handle.action interface of Dahua EIMS. Affected versions prior to 2240008 allow attackers to execute arbitrary system commands remotely without requiring authentication. The flaw is specifically found in the captureCommand parameter, which can be manipulated by sending crafted HTTP requests. This vulnerability can lead to complete server compromise, allowing attackers to execute commands at the OS level, potentially causing severe damage and information leaks. Unchecked, this can pose significant risks to the availability and integrity of the EIMS platform and its managed data. Immediate remediation actions are essential to prevent exploitation of this vulnerability and protect against unauthorized access.

Technical details reveal that the captureCommand parameter in the capture_handle.action interface is vulnerable to injection attacks due to a lack of proper sanitization. The endpoint processes user-supplied data without authentication, making it susceptible to unauthorized command execution. Attackers can exploit this vulnerability by crafting HTTP requests that inject OS-level commands, such as command strings in GET method requests. The misuse of this functionality can facilitate unauthorized interactions with the system and allow for further malicious activities, including the installation of malware or backdoor entry points. Enhanced input validation and stringent authentication checks could mitigate these risks.

Exploitation of this Remote Code Execution vulnerability can have severe consequences, including unauthorized access to sensitive information, manipulation of system files, and potential backdoor installations. An attacker could leverage this access to pivot into connected networks, gathering intelligence and executing further attacks across the internal environment. Service disruptions are also likely, affecting not just the Dahua EIMS but potentially other interconnected emergency management services. Such unauthorized activities compromise the system's reliability, leading to a loss of trust and operational integrity.

REFERENCES

• https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/dahua/dahua-eims-capture-handle-rce.yaml
• https://cn-sec.com/archives/2554372.html
• https://github.com/wy876/POC/blob/main/%E5%A4%A7%E5%8D%8EEIMS-capture_handle%E6%8E%A5%E5%8F%A3%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md