abraxas/ats-cripts-rri-uafApache Traffic Server 10.2.0 - High - Remote - Crash - Cripts From/To URL UAF
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · ats-cripts-rri-uaf
Class: Crash Reach: Remote
Apache Traffic Server 10.2.0 (b1df7334) - Apache Software Foundation
Cripts Remap::From / To URL still re-read the stack TSRemapRequestInfo after TSRemapDoRemap returns. RemapPlugins stack-allocates rri. Context keeps the pointer. reset() drops the unique_ptrs; later Get() / Host::GetSV feeds the dead RRI into TSUrlHostGet. Fatal: sdk_sanity_check_mbuffer then SIGABRT.
Client::URL was patched not to. Lua cleared rri after remap. Cripts From/To did not. Default ENABLE_CRIPTS is off. No cripts on stock remap.
| ID | no CVE yet |
| Class | Crash (UAF of stack RRI) |
| Reach | Remote (unauth HTTP through a From/To post-remap cript) |
| CWE | CWE-416 |
| CVSS | High: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Product | Apache Traffic Server |
| Affected | 10.2.0 (b1df7334b39a878971c376da849e8da4984918b6) Cripts From/To URL after DoRemap |
| Auth | none |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18780 only |
I pinned public tag 10.2.0 peel b1df7334. The lab is a RelWithDebInfo source build with Cripts on. CONTROL Client::URL 200, process stayed up. POC Host ats-poc SIGABRT exit 134.
Hit a remap cript that touches From/To URL after do_remap (do_send_response in the lab). Unauth GET is enough.
| Method | Sink | Privilege |
|---|---|---|
Unauth GET Host ats-poc through a do_send_response cript that calls Remap::From::URL::Get / To::URL::Get | stack TSRemapRequestInfo (RemapPlugins.cc:41-65); rriValid() deref (Context.hpp:70-73); _initialize (Urls.cc:525-561) | Availability (lab-proven): SIGABRT, exit 134, connection reset. traffic_server dies. |
| Same | SDK Fatal abort | Integrity: not RIP control. Class stays Crash. Lab. |
Lab-proven vs inferred: process death is lab (RelWithDebInfo SIGABRT). Memory corruption to RIP is not claimed.
Requires: Cripts built (ENABLE_CRIPTS=ON) and a remap cript that touches From/To URL after DoRemap. Default: no.
| Surface | Lab |
|---|---|
| CONTROL Client::URL only | 200, process stayed up |
| File::Path::Rebase jail | closed on this pin (CVE-2026-58177 issue 32) |
| Geo IPEndpoint sockaddr | closed |
| Query-key abort | closed (missing hash skipped) |
| Global cripts | rri == nullptr; rriValid() fail-closes without deref |
| Instance OOB / DoRemap-after-Release | closed (CVE-2026-58177) |
Stock remap / ENABLE_CRIPTS off | leftover does not apply |
Not CVE-2026-58177 as disclosed. Lua cleared rri after remap; Cripts From/To did not.
python3 ats-cripts-rri-uaf-Abraxas-Labs.py
or
cd lab
./run.sh
Loopback 127.0.0.1:18780. Compose project ats-cripts-rri-uaf. RelWithDebInfo image. Witness ATS-CRIPTS-RRI-UAF-WITNESS. Last line:
SUCCESS ats-cripts-rri-uaf control-http=200 control-alive=yes poc-crash=sigabrt poc-http=None reset=1 ATS-CRIPTS-RRI-UAF-WITNESS
Null the Context rri when TSRemapDoRemap returns, the way Lua does. Or treat From/To URL like Client::URL: do not re-init from RRI on later hooks. rriValid() must not dereference a dead struct. Copy mapFromUrl / mapToUrl into owned MLocs during do_remap if post-remap From/To is a feature.
Until then, do not evaluate %{FROM-URL:...} / %{TO-URL:...} (or borrow those URL objects) on do_post_remap / do_send_request / do_read_response / do_send_response / do_cache_lookup.
b1df7334b39a878971c376da849e8da4984918b6)src/proxy/http/remap/RemapPlugins.ccinclude/cripts/Epilogue.hppsrc/cripts/Urls.cc Remap::From::URL / To::URLinclude/cripts/Context.hpp rriValid../, Geo sockaddr, query-key abort, Client::URL MLoc