Headline
CVE-2023-31272: TALOS-2023-1765 || Cisco Talos Intelligence Group
A stack-based buffer overflow vulnerability exists in the httpd do_wds functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability.
SUMMARY
A stack-based buffer overflow vulnerability exists in the httpd do_wds functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability.
CONFIRMED VULNERABLE VERSIONS
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
Yifan YF325 v1.0_20221108
PRODUCT URLS
YF325 - https://yifanwireless.com/entry-level-wifi-router/yf325-series-gprs/3g/4g-wifi-router-with-sim-card-slot.html
CVSSv3 SCORE
8.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
CWE-121 - Stack-based Buffer Overflow
DETAILS
The Yifan YF325 is an industrial cellular router. This device is designed for M2M and IOT applications, allowing remote management, offering several VPN services and many other features.
The YF325 router provides a series of APIs. The API that manages the Wireless_WDS* endpoints uses the httpd’s do_wds function:
void do_wds(undefined4 param_1,char* URL_path,undefined4 fd)
{
[...]
dash_in_URL = indexof(URL_path,L'-'); [1]
strcpy(filename,URL_path + dash_in_URL + 1); [2]
[...]
} The `URL_path` parameter is the request's URL path without the leading slash. This function takes, at `[1]`, the index of the first `-` in `URL_path`; if there is no such character, the function `indexof` will return -1. At `[2]` the result of the `indexof` function is used to copy either the whole `URL_path` string if no `-` is present, or only the string after the `-` if it is. The string is copied into a static buffer. Because the function used to copy the string is `strcpy` and no check is performed on the length of what is copied, the `do_wds` function is vulnerable to a stack-based buffer overflow. This vulnerability can be reached without authentication.
TIMELINE
2023-06-28 - Initial Vendor Contact
2023-07-06 - Vendor Disclosure
2023-10-11 - Public Release
Discovered by Francesco Benvenuto of Cisco Talos.
Related news
Attackers could exploit these vulnerabilities in the Yifan YF325 to carry out a variety of attacks, in some cases gaining the ability to execute arbitrary shell commands on the targeted device.