CVE-2023-3836

What it actually does

The described flaw is an unauthenticated, remotely reachable unrestricted file upload in Dahua Smart Park Management versions up to 20230713, affecting the /emap/devicePoint_addImgIco?hasSubsystem=true upload handler. If the application accepts attacker-controlled content without enforcing authentication, file type, extension, storage path, or execution controls, an attacker can place a server-side script or other malicious file on the web server and potentially execute it through a subsequent HTTP request. The CVSS vector indicates network exploitation, low complexity, no privileges, and no user interaction, with potential full confidentiality, integrity, and availability impact. Note: the supplied product metadata also lists libtiff/libtiff GIT with fixed commit 8b20804fc0ddeaa93667b799b5e1a2a7dc9e3fb2, which is inconsistent with the Dahua endpoint described; teams should validate both the vulnerable web application exposure and any dependency tracking records before closing remediation.

Why it matters to the business

Successful exploitation can give an external attacker control over the affected management application, enabling data theft, tampering with device or facility-management functions, disruption of operations, and pivoting into adjacent systems. Because exploit code is public, exploit maturity is weaponized, the EPSS probability is high at 0.7367, and the issue has been public for more than three years, internet-exposed deployments should be treated as high-risk even though it is not currently listed in CISA KEV and is not flagged as ransomware-used.

How an attack unfolds

An attacker first identifies a reachable Dahua Smart Park Management instance and probes the /emap/devicePoint_addImgIco endpoint. They then send a crafted multipart upload request to the upload parameter, taking advantage of missing or insufficient validation to store content that should not be accepted by the application. If executable file types or attacker-controlled file locations are permitted, the attacker requests the uploaded file to execute code in the context of the web application. After execution, the attacker may establish persistence using a web shell, collect configuration files and credentials, modify application data, stage additional tooling, or use the compromised server as a foothold for lateral movement. Public exploit availability and high EPSS make opportunistic scanning and automated exploitation plausible.

How to fix it

Upgrade Dahua Smart Park Management to a vendor-provided version later than 20230713 or apply the vendor hotfix that corrects the upload validation issue. If no reliable vendor fix is available, remove the system from direct internet exposure, restrict access to trusted management networks or VPN, and block unauthenticated access to /emap/devicePoint_addImgIco at a reverse proxy or WAF. Enforce strict server-side upload controls: authentication and authorization checks, extension allowlisting, MIME and magic-byte validation, randomized filenames, non-executable upload directories, size limits, malware scanning, and denial of double extensions or path traversal sequences. Review and remove any unexpected uploaded files, especially server-side scripts. Because the supplied package metadata lists libtiff/libtiff GIT as fixed in commit 8b20804fc0ddeaa93667b799b5e1a2a7dc9e3fb2, software supply-chain owners should also verify whether that dependency record is applicable and update any tracked libtiff source builds to that commit or later if relevant.

How to confirm the fix worked

Confirm that exposed Dahua Smart Park Management instances are no longer running versions up to 20230713 and that the upload endpoint is protected by authentication and authorization. Test from an unauthenticated network position that POST requests to /emap/devicePoint_addImgIco?hasSubsystem=true are rejected, blocked, or constrained to safe image uploads only. Verify that uploaded files are stored outside executable web paths and cannot be requested as executable content. Review WAF, reverse proxy, and application server rules to confirm the endpoint is explicitly controlled. Run authenticated file-system checks for unexpected files created around the time of suspicious upload requests. For dependency validation, confirm any relevant libtiff/libtiff GIT build includes commit 8b20804fc0ddeaa93667b799b5e1a2a7dc9e3fb2 or a later upstream revision.

Typical attack path

1. Scan for internet-exposed Dahua Smart Park Management services or fingerprintable /emap/ application paths.
2. Send HTTP requests to /emap/devicePoint_addImgIco?hasSubsystem=true to determine whether the upload handler is reachable without authentication.
3. Submit a crafted multipart/form-data request using the upload parameter with a malicious or policy-violating file.
4. Identify the server-side storage location or derive the resulting URL for the uploaded content.
5. Request the uploaded file to trigger execution or confirm file placement.
6. Use the resulting access to run commands, deploy a web shell, collect credentials, alter application data, or pivot to connected systems.
7. Clean up obvious artifacts or rename uploaded files to blend in with normal application content.

How to detect it

Review HTTP access logs, reverse proxy logs, WAF events, application logs, EDR telemetry, and web server file-system artifacts. Look for unauthenticated or unusual POST requests to /emap/devicePoint_addImgIco?hasSubsystem=true using multipart/form-data and the upload field, especially from unfamiliar IP addresses, scanners, or requests followed by GET requests to newly created files. Investigate uploaded files with executable extensions such as .jsp, .jspx, .war, .php, .aspx, .ashx, .jar, .class, .sh, or double extensions such as .jpg.jsp. On the server, search web roots, upload directories, temporary directories, and application deployment directories for recently created or modified files near the timestamp of suspicious requests. Correlate with process creation events showing web server or application server processes spawning shells or administrative utilities. Also look for outbound network connections initiated by the web/application server shortly after upload activity, which may indicate command-and-control or tool retrieval. Because exploit code is public and weaponized, include broad historical searches back to first exposure or patch date rather than only recent telemetry.

• /emap/devicePoint_addImgIco?hasSubsystem=true
• devicePoint_addImgIco
• hasSubsystem=true
• multipart/form-data
• name="upload"
• POST /emap/devicePoint_addImgIco
• /emap/devicePoint_addImgIco
• filename="*.jsp"
• filename="*.jspx"
• filename="*.war"
• filename="*.php"
• filename="*.aspx"
• filename="*.ashx"
• filename="*.jar"
• filename="*.class"
• filename="*.jpg.jsp"
• filename="*.png.jsp"
• filename="*.gif.jsp"
• filename="*.ico.jsp"
• cmd.exe /c
• /bin/sh -c
• powershell.exe
• wget http
• curl http
• bash -i
• Runtime.getRuntime().exec
• ProcessBuilder(

What your security team should do

• Immediately inventory externally reachable Dahua Smart Park Management instances and prioritize those running versions up to 20230713.
• Block or restrict access to /emap/devicePoint_addImgIco?hasSubsystem=true until the application is confirmed patched and upload controls are verified.
• Search historical web, reverse proxy, WAF, EDR, and file-system telemetry for upload attempts and subsequent execution of newly uploaded files.
• Treat any successful unauthenticated upload of executable content as a likely compromise and begin incident response, including credential rotation for application, database, and service accounts accessible from the host.
• Patch or upgrade the affected application, and separately reconcile the inconsistent libtiff fixed-version metadata by verifying whether commit 8b20804fc0ddeaa93667b799b5e1a2a7dc9e3fb2 applies to any tracked builds.
• Add SIEM detections for multipart POST requests to the vulnerable endpoint, especially with script-like file extensions, double extensions, unusual user agents, or immediate follow-on GET requests to uploaded content.
• Place management applications for physical security, facilities, and device administration behind VPN or private administrative access paths rather than exposing them directly to the internet.