ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
53 lines
No EOL
8 KiB
Text
53 lines
No EOL
8 KiB
Text
Type confusion can occur when processing a H264 packet. In the method PacketBuffer::FindFrames in modules/video_coding/packet_buffer.cc there is a loop on line 296 that goes through the data_buffer_ vector backwards. The flag is_h264 is set before this loop, and if it is true, the loop extracts and sets h264 struct specific data in each packet of the buffer. This flag is not updated for each packet. So if a number of non-h264 packets are followed by a h264 packet, a VP8 or VP9 packet can be treated at a h264 check, allowing several bounds checks to be bypassed.
|
|
|
|
1) unzip the attached webrtc-from-chat2.zip on a local webserver
|
|
2) fetch the webrtc source (https://webrtc.org/native-code/development/), and replace pc/srtptransport.cc and third_party/libsrtp/crypto/cipher/cipher.c with the version attached to the issue
|
|
3) build webrtc, including the examples
|
|
4) run the attached webrtcserver.py with python 3.6 or higher
|
|
5) start the peerconnection_client sample in the webrtc examples. Connect to the recommended server, and then select test2 as the peer to connect to
|
|
6) visit http://127.0.0.1/webrtc-from-chat/index.html in chrome
|
|
7) Enter any username and hit "Log in"
|
|
8) Type anything into the chat window at the bottom and hit send
|
|
|
|
Though the attached PoC requires user interaction, it is not necessary to exercise this issue in a browser.
|
|
|
|
This issue affects any browser that supports H264, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support H264, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.
|
|
|
|
Please note it is not sufficient to fix this issue in Chrome, it needs to be upstreamed to webrtc, so all users of the library can get the fix.
|
|
|
|
Adding stack trace:
|
|
|
|
#0 0x55bd530e0721 in webrtc::video_coding::PacketBuffer::FindFrames(unsigned short) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/video_coding/packet_buffer.cc:314:33
|
|
#1 0x55bd530dcb24 in webrtc::video_coding::PacketBuffer::InsertPacket(webrtc::VCMPacket*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/video_coding/packet_buffer.cc:126:20
|
|
#2 0x55bd530d0592 in webrtc::RtpVideoStreamReceiver::OnReceivedPayloadData(unsigned char const*, unsigned long, webrtc::WebRtcRTPHeader const*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:242:19
|
|
#3 0x55bd52f225ed in webrtc::RTPReceiverVideo::ParseRtpPacket(webrtc::WebRtcRTPHeader*, webrtc::PayloadUnion const&, unsigned char const*, unsigned long, long) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/rtp_rtcp/source/rtp_receiver_video.cc:109:26
|
|
#4 0x55bd52f16fbd in webrtc::RtpReceiverImpl::IncomingRtpPacket(webrtc::RTPHeader const&, unsigned char const*, unsigned long, webrtc::PayloadUnion) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/rtp_rtcp/source/rtp_receiver_impl.cc:192:42
|
|
#5 0x55bd530d144f in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:410:20
|
|
#6 0x55bd530d1142 in webrtc::RtpVideoStreamReceiver::OnRecoveredPacket(unsigned char const*, unsigned long) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:256:3
|
|
#7 0x55bd530f8098 in webrtc::UlpfecReceiverImpl::ProcessReceivedFec() /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc:239:35
|
|
#8 0x55bd530d3fa9 in webrtc::RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader(unsigned char const*, unsigned long, webrtc::RTPHeader const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:430:23
|
|
#9 0x55bd530d134b in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:401:5
|
|
#10 0x55bd530d1fc2 in webrtc::RtpVideoStreamReceiver::OnRtpPacket(webrtc::RtpPacketReceived const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/video/rtp_video_stream_receiver.cc:301:3
|
|
#11 0x55bd40d97311 in webrtc::RtpDemuxer::OnRtpPacket(webrtc::RtpPacketReceived const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/call/rtp_demuxer.cc:157:11
|
|
#12 0x55bd40d9c1a1 in webrtc::RtpStreamReceiverController::OnRtpPacket(webrtc::RtpPacketReceived const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/call/rtp_stream_receiver_controller.cc:55:19
|
|
#13 0x55bd52e3fe39 in webrtc::internal::Call::DeliverRtp(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/call/call.cc:1292:36
|
|
#14 0x55bd52e407e3 in webrtc::internal::Call::DeliverPacket(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/call/call.cc:1316:10
|
|
#15 0x55bd5358b001 in cricket::WebRtcVideoChannel::OnPacketReceived(rtc::CopyOnWriteBuffer*, rtc::PacketTime const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/media/engine/webrtcvideoengine.cc:1444:26
|
|
#16 0x55bd52deb9e2 in cricket::BaseChannel::ProcessPacket(bool, rtc::CopyOnWriteBuffer const&, rtc::PacketTime const&) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/pc/channel.cc:0:21
|
|
#17 0x55bd52e09370 in rtc::AsyncInvoker::OnMessage(rtc::Message*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../third_party/webrtc/rtc_base/asyncinvoker.cc:45:22
|
|
#18 0x55bd52ca1711 in jingle_glue::JingleThreadWrapper::Dispatch(rtc::Message*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../jingle/glue/thread_wrapper.cc:157:22
|
|
#19 0x55bd52ca29ee in jingle_glue::JingleThreadWrapper::RunTask(int) /usr/local/google/home/natashenka/chromium/src/out/asan/../../jingle/glue/thread_wrapper.cc:279:7
|
|
#20 0x55bd447abaf5 in Run /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/callback.h:96:12
|
|
#21 0x55bd447abaf5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/debug/task_annotator.cc:101:0
|
|
#22 0x55bd44809665 in base::MessageLoop::RunTask(base::PendingTask*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/message_loop/message_loop.cc:319:25
|
|
#23 0x55bd4480a8d4 in DeferOrRunPendingTask /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/message_loop/message_loop.cc:329:5
|
|
#24 0x55bd4480a8d4 in base::MessageLoop::DoWork() /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/message_loop/message_loop.cc:373:0
|
|
#25 0x55bd44812bff in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/message_loop/message_pump_default.cc:37:31
|
|
#26 0x55bd4487fdb1 in base::RunLoop::Run() /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/run_loop.cc:131:14
|
|
#27 0x55bd448ff6c4 in base::Thread::ThreadMain() /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/threading/thread.cc:337:3
|
|
#28 0x55bd449ccaa4 in base::(anonymous namespace)::ThreadFunc(void*) /usr/local/google/home/natashenka/chromium/src/out/asan/../../base/threading/platform_thread_posix.cc:76:13
|
|
#29 0x7fedd89fa493 in start_thread ??:0:0
|
|
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45123.zip |