[0day-rubbish] NoMachine Terminal Server 10.0.57 two vulnerabilities
disclosure via Fulldisclosure ·
0day Rubbish Research Team is publicly disclosing two vulnerabilities in NoMachine Terminal Server 10.0.57. Vulnerability 1 — Pre-authentication heap memory corruption (out-of-bounds write to double-free) (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-787) NoMachine Terminal Server is a closed-source remote-desktop gateway used by enterprises to deliver virtual desktops and remote sessions over HTTPS. The nxwebrunner CGI RequestCollector::parsePOST contains an unbounded quote-scan loop and an unbounded name-copy loop; a single unauthenticated multipart/form-data POST with a filename attribute reads past the body terminator and overflows heap chunk metadata. The cleanup path frees the corrupted chunk, producing a double-free abort and an RCE-capable heap-overflow primitive (verified: 9/10 trigger requests crashed). Authentication: unauthenticated / pre-auth Vulnerability 2 — Pre-authentication stack buffer overflow with return-address control (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-787) In the same nxwebrunner CGI, RequestCollector::parsePOST copies attacker-controlled multipart name and value fields and then executes sprintf(stack_buf, "%s=%s&", name, value) into a 1032-byte stack buffer. When name + value + 2 exceeds 1032, the write overwrites saved registers and the return address. The binary is non-PIE with stack canaries disabled, so the attacker controls the return address (verified in core dumps); stable RCE currently requires a leak primitive, but the pre-auth crash is deterministic. Authentication: unauthenticated / pre-auth Full technical analyses and reproducible proofs-of-concept: https://0day-rubbish.com/blog/nomachine-terminal-server-preauth-heap-corruption https://0day-rubbish.com/blog/nomachine-terminal-server-preauth-stack-overflow Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE IDs are pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/