DoS segfault (NULL pointer deref) in SOPE / SOGo

[Stefan Bühler <source () stbuehler de>]

Hello,

I found a DoS bug in SOPE, the set of Objective-C frameworks powering
SOGo [1].

It is way too easy to trigger with curl:

    curl -d 'x=' 'https://.../SOGo/?x='

As far as I can tell all versions since SOGo-2.0.2 (2012-10-29) are
affected.

# Details

I found it inspecting multiple SOGo crashes triggered by someone
hitting URLs like `/OA_HTML/BneViewerXMLService?bne:uueupload=TRUE`
with `POST` that my search engine associates with "Oracle E-Business
Suite (EBS)".

The crash happens in NGHashMap.m line 790 [2], as root->last is NULL:

    root->last->next = element;

NGHashMap maps a key to a single-linked list of values.

It turns out `-[NGMutableHashMap addObjects:count:forKey:]` is the
only function maintaining the `root->last` pointer; everything else in
this file doesn't touch it.

The SOPE request handling first parses the POST body for
"formParameters", then clones that NGHashMap (the copied nodes have
`last == NULL`), and then merges the query string parameters into it;
if there is a duplicate key the bug triggers.

I'd like to point out that the linked-list implementation is quite
bad.  It wastes memory by using the same struct for the root node
(with count and last metadata) and the member nodes, and seems to
throw exceptions (e.g. when values are nil) but isn't exception
safe (metadata isn't updated consistently).

See attached patch for an attempt to maintain the `last` pointer
properly across all methods; it seems to work for me (on top of
5.8.0-1 in debian/bookworm); submitted to upstream in [4].

In the long run at least the linked-list implementation should
probably be replaced by using some properly tested library.

The `last` handling was introduced in dfceefc 2012-10-15 [3], and I
think it has been broken since then.

(I haven't actually tried to reproduce it with latest upstream, but I
don't think any of the code has been touched in relevant ways.)

cheers,
Stefan

[1] https://www.sogo.nu/
[2] https://github.com/Alinto/sope/blob/3146fbdb6ff3314e37e5c3682deeeef7d0f32064/sope-core/NGExtensions/NGHashMap.m#L790
[3] https://github.com/Alinto/sope/commit/dfceefcb141c1b31b26eea19ca07d3916d663315
[4] https://github.com/Alinto/sope/pull/69

Attachment: 0001-NGHashMap-keep-root-last-consistent-to-fix-segfault-.patch
Description: