Monday, 28 May 2018

Abusing IVR Systems - Legacy Telecom [CVE-2018-11518]

Hi Internet,

CVE-2018-11518, (Everything old, is new again.)
A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can record these frequencies and use them to activate services or to get sensitive information.

PS: This is a request-forgery issue when the required series of DTMF signals for a service activation is predictable (e.g., the IVR system does not speak a nonce to the caller). In this case, the IVR system accepts an activation request from a less-secure channel (any loudspeaker in the caller's physical environment) without verifying that the request was intended (it matches a nonce sent over a more-secure channel to the caller's earpiece).

Video PoC: Phreak Attack


Wednesday, 23 May 2018

A story of CVE-2018-11396 - BFuzz

Hi Internet,

ephy-session.c in in GNOME Web (aka Epiphany) through allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted call.

Let's get started,
Few days back we (Team w00t) created an small framework which fuzz browser's, basically its more of an automation we named it as BFuzz.

BFuzz takes .html & .xml as an input, open's up your browser with a new instance and pass multiple testcases which is present in recurve folder of BFuzz, we can simply keep adding testcases in recurve
Manuel Caballero‏ tweeted about MS Edge - Address Bar Spoof, which we came across, we minimized the testcase and added that to BFuzz which was causing  crash in Epiphany, a GNOME based browser.

win ="hello world!");
We reported this to Epiphany dev team in an hour the bug was changed from HIGH to CRITICAL. and team started working on it, below is the stack trace for reference.

ftw@ftw-box:~$ gdb epiphany
(gdb) run
Starting program: /usr/bin/epiphany 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/".
[New Thread 0x7fffe08bc700 (LWP 2279)]
[New Thread 0x7fffdee51700 (LWP 2280)]
[New Thread 0x7fffde650700 (LWP 2281)]
[New Thread 0x7fffdcdd5700 (LWP 2282)]
[New Thread 0x7fffd7fff700 (LWP 2283)]
[New Thread 0x7fffd77fe700 (LWP 2284)]
[New Thread 0x7fffd6ffd700 (LWP 2285)]
[New Thread 0x7fffd67fc700 (LWP 2286)]
[New Thread 0x7fffd5b8c700 (LWP 2287)]
[New Thread 0x7fffd538b700 (LWP 2288)]
[New Thread 0x7fff8f486700 (LWP 2294)]
[New Thread 0x7fff8da1e700 (LWP 2304)]
[New Thread 0x7fff8d21d700 (LWP 2305)]
[New Thread 0x7fff8ea7f700 (LWP 2315)]
[Thread 0x7fffd5b8c700 (LWP 2287) exited]
[Thread 0x7fffd67fc700 (LWP 2286) exited]

Thread 15 "pool" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff8ea7f700 (LWP 2315)]
0x00007ffff7b75db7 in ?? () from /usr/lib/x86_64-linux-gnu/epiphany-browser/
(gdb) bt
#0  0x00007ffff7b75db7 in ?? () from /usr/lib/x86_64-linux-gnu/epiphany-browser/
#1  0x00007ffff7079be6 in ?? () from /usr/lib/x86_64-linux-gnu/
#2  0x00007ffff73fe7d0 in ?? () from /usr/lib/x86_64-linux-gnu/
#3  0x00007ffff73fde05 in ?? () from /usr/lib/x86_64-linux-gnu/
#4  0x00007fffefc246db in start_thread (arg=0x7fff8ea7f700) at pthread_create.c:463
#5  0x00007ffff5e4c88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
It crashes when JS opens an invalid URI and CVE-2018-11396 was assign to this issue. If you have not tried BFuzz yet, do have a look and please feel to PR and contribute more in it.  PS: BFuzz in action, video PoC

A shoutout to Zubin and Hardik (Teamw00t) we work together to find security bugs, Hope you like the read.

Dhiraj (Teamw00t)

Wednesday, 16 May 2018

Bufferoverflow() in ICU4C

Hi Internet,

This blog is a part of contribution in International Components for Unicode (ICU4C), We have added support for, check bufferoverflow() in ICU4C, (sprintf without bounds)

While going through the source code of nodejs, specifically file pkgdata.cpp#L911-L915

Vulnerable Code:
         sprintf(libFileNames[LIB_FILE], "%s%s", 

The above code does not check for buffer overflows() which is CWE-120 a classic buffer overflow. we were still not clear with the attack vector over here but still submitted an issue in nodejs.

With in an hour this issue was mark as `intl` which means this issue is related to i18n implementation i.e  ICU, TextEncoder/TextDecoder.

We started google-ing more about ICU, here is the wiki page and home page for same, so ICU is a package which is used in most of the application apart from nodejs, such as applications developed by google, apple, GNU and much more.... (Whoooaaaa! 😱)

Many thanks to Steven R. Loomis who confirmed this is a bug and dosen't checks for buffer overflow, but their are if's and but's to cause an overflow here.

Steven say's:
  • This code is in tooling - it's used sometimes at build time (may not be hit in a default node build)
  • I don't think there is an option even to node's ./configure that could cause an overflow here. It is at least unlikely.
We confirmed the same in current ICU source.
Actually our best practice is to use C++ objects (std::string or equivalent) and avoid this kind of buffer manipulation entirely.

And he filed an upstream bug in ICU project as well, Thank you Steven 😇 However, We have requested a CVE for this bug and its in process.

The only impact of the issue is that, if a local user chooses to specify long strings containing shellcode when building any package, they can attack themselves by executing arbitrary code in the context of their own user account.


A shoutout to Zubin and Hardik (Teamw00t) we worked together to find this bug, Hope you like the read.

Dhiraj (Teamw00t)