CODESYS V3 Unauthenticated Remote Heap Buffer Overflow

CVE-2019-18858: Unauthenticated Remote Heap Buffer Overflow

While developing a Nessus plugin to detect CVE-2019-13548, Tenable found an unauthenticated remote heap buffer overflow vulnerability in CODESYS V3 runtime component CmpWebServerHandlerV3. The flaw exists in CmpWebServerHandlerV3.dll (file version 3.5.15.0) due to improper validation of user-supplied data sent to the CODESYS V3 web server URL endpoint /WebVisuV3.

The following code snippet shows the vulnerability:

.text:1000306D      call    HandleVisuService
.text:10003073      add     esp, 14h
.text:10003076      mov     [ebp+rc], eax
.text:10003079      mov     eax, [ebp+HdrSizePlus4]    ; attacker-controlled size
.text:1000307C      push    eax
.text:1000307D      mov     ecx, [ebp+pbData]          ; attacker-controlled data
.text:10003080      push    ecx
.text:10003081      mov     edx, [ebp+pbCommBuf]       ; heap buffer allocation size can
.text:10003081                                         ; be controlled by the attacker
.text:10003084      push    edx
.text:10003085      call    memcpy

The attacker sends a WEB_CLIENT_OPENCONNECTION HTTP message to control the allocation size of a heap buffer pointed by pbCommBuf. He or she then sends a WEB_CLIENT_RUN_SERVICE HTTP message to cause a memcpy operation with source data contents and length controlled by the attacker. This could cause a heap buffer overflow condition. The following shows 0x1004-bytes of attacker-controlled data is being copied to a heap buffer of a few bytes:

0:015> kb
 # ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
00 0420fe5c 01a71464 01a78110 00000002 003c68d0 CmpWebServerHandlerV3!ComponentEntry+0x13d5
01 0420fea4 01a34ea3 01a4f568 00000000 00000000 CmpWebServerHandlerV3+0x1464
02 0420fed4 01a35788 01a4f568 00001018 00000000 CmpWebServer!ComponentEntry+0x3c63
03 0420fefc 01a34a20 01a4f568 0420ff44 01a342c4 CmpWebServer!ComponentEntry+0x4548
04 0420ff08 01a342c4 01a4f568 01a4f558 01a4f558 CmpWebServer!ComponentEntry+0x37e0
05 0420ff44 01a32cbe 0420ff88 005f41c8 00980f44 CmpWebServer!ComponentEntry+0x3084
06 0420ff4c 005f41c8 00980f44 7259102a 00000000 CmpWebServer!ComponentEntry+0x1a7e
07 0420ff88 77e2efac 00980f38 0420ffd4 77f23618 CODESYSControlService+0x1f41c8
08 0420ff94 77f23618 00980f38 73db7c92 00000000 kernel32!BaseThreadInitThunk+0xe
09 0420ffd4 77f235eb 005f4170 00980f38 00000000 ntdll!__RtlUserThreadStart+0x70
0a 0420ffec 00000000 005f4170 00980f38 00000000 ntdll!_RtlUserThreadStart+0x1b
0:015> r
eax=00001004 ebx=00980f38 ecx=021566b4 edx=003be738 esi=00000000 edi=00000000
eip=01a73085 esp=0420fe00 ebp=0420fe5c iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
CmpWebServerHandlerV3!ComponentEntry+0x13d5:
01a73085 e8f21e0000      call    CmpWebServerHandlerV3!ComponentEntry+0x32cc (01a74f7c)
0:015> dd esp L3
0420fe00  003be738 021566b4 00001004
0:015> !heap -p -a 003be738 
    address 003be738 found in
    _HEAP @ 2d0000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        003be6d8 000d 0000  [00]   003be6e0    0005d - (busy)

 
0:015> db 021566b4 L1004
021566b4  50 50 00 10 04 00 01 00-00 00 00 00 ff ff ff 07  PP..............
021566c4  00 00 00 00 41 41 41 41-41 41 41 41 41 41 41 41  ....AAAAAAAAAAAA
021566d4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
...
021576a4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
021576b4  41 41 41 41                                      AAAA