b1ack0wl/miniupnpd_pocminiupnpd <= v2.1 向けの範囲外読み取り PoC
obj->path が526バイトを超えるコールバックURIを含む SUBSCRIBE リクエストを送信することで引き起こされます。snprintf() の戻り値を検証していないことです。snprintf() は実際にコピーしたバイト数ではなく、コピー できたであろう バイト数を返すためです。miniupnpd を利用する他のデバイスも影響を受ける可能性があります。static void upnp_event_prepare(struct upnp_event_notify * obj)
{
obj->buffersize = 1024; /* Static Buffer Size */
obj->buffer = malloc(obj->buffersize);
[...]
obj->tosend = snprintf(obj->buffer, obj->buffersize, notifymsg,
obj->path, obj->addrstr, obj->portstr, l+2,
obj->sub->uuid, obj->sub->seq,
l, xml);
obj->state = ESending;
static void upnp_event_send(struct upnp_event_notify * obj)
{
int i;
i = send(obj->s, obj->buffer + obj->sent, obj->tosend - obj->sent, 0);
snprintf() の man ページエントリ
RETURN VALUE
Upon successful return, functions return the number of characters printed
(excluding the null byte used to end output to strings).
The functions snprintf() and vsnprintf() do not write more than size bytes
(including the terminating null byte ('\0')). If the output was truncated
due to this limit, then the return value is the number of characters
(excluding the terminating null byte) which would have been written to the
final string if enough space had been available. Thus, a return value of size
or more means that the output was truncated.
usage: miniupnpd_poc.py [-h] [--callback_ip CALLBACK_IP]
[--callback_port CALLBACK_PORT] [--timeout TIMEOUT]
[--leak_amount LEAK_AMOUNT]
target_ip target_port
Miniupnpd <= v2.1 read out-of-bounds vulnerability
positional arguments:
target_ip IP address of vulnerable device.
target_port Target Port.
optional arguments:
-h, --help show this help message and exit
--callback_ip CALLBACK_IP
Local IP address for httpd listener. (default: None)
--callback_port CALLBACK_PORT
Local port for httpd listener. (default: None)
--timeout TIMEOUT Timeout for http requests (seconds). (default: 5)
--leak_amount LEAK_AMOUNT
Amount of arbitrary heap data to leak (in Kb).
(default: 1)
