---

Advisor Information

Student Information

Course Information

---

📌 About the Project (CVE-2023-4863)

This project has been prepared to analyze the CVE-2023-4863 (libwebp Heap Buffer Overflow) vulnerability for educational purposes and to demonstrate practically how such anomalies can be detected in systems from the defense (Blue Team) side.

Vulnerability Details

• CVE ID: CVE-2023-4863
• Target Component: libwebp (Library processing WebP image format)
• Vulnerability Type: Heap Buffer Overflow
• Criticality Level: Critical (CVSS 10.0)

Impact Scope of the Vulnerability

This vulnerability directly affected many ecosystems in the web world:

• Chromium-based web browsers such as Google Chrome, Microsoft Edge, Brave, Opera
• Desktop applications using Electron / Chromium infrastructure such as 1Password, Signal, Discord, Skype
• Mobile applications and operating system graphics components using libwebp

How Does the Attack Occur?

1. The attacker creates a WebP (VP8L lossless format) file that contains a specially crafted, malicious, and asymmetric Huffman table.
2. When the target system attempts to process the image, the ReadHuffmanCodes function allocates less memory space for the table than needed.
3. During table construction (BuildHuffmanTable), a write beyond the allocated memory space (Out-Of-Bounds Write) occurs.
4. As a result of the memory overflow, the attacker can overwrite adjacent control structures in the heap area to gain remote code execution (RCE) capability.

Defense and Test Components (Blue Team Focused)

For security policy reasons, no actual and weaponized Red Team code (exploit) is kept in the system. The vulnerability is tested structurally.

• src/blue_team/webp_scanner.py: Statically examines WebP chunk structures and detects abnormal sizes.
• src/blue_team/WebpValidator.java: A Java defensive code example that mimics file upload scenarios, prevents size spoofing with a fail-fast logic, and runs without crashing (no exceptions) on corrupted files.
• src/red_team/poc.py: A training test generator that does not contain an actual payload, but deliberately reports a fake chunk size of 60MB to test whether Blue Team analysis tools are triggered.
• Docker and Valgrind: A fully isolated laboratory built with the vulnerable libwebp-1.3.1. Dynamic analysis via Valgrind through the analyze_memory.sh script to examine memory errors (Invalid Write).

Web Dashboard

Security findings are logged via the created JSON logger infrastructure and visualized asynchronously and live through the Blue Team Dashboard (HTML/JS/CSS) located under the src/public directory.

Interface Demo