Embedding NULL Bytes
Attack Pattern ID: 52 (Detailed Attack Pattern Completeness: Complete)Typical Severity: HighStatus: Draft
+ Description

Summary

An attacker embeds one or more null bytes in input to the target software. This attack relies on the usage of a null-valued byte as a string terminator in many environments. The goal is for certain components of the target software to stop processing the input when it encounters the null byte(s).

Attack Execution Flow

  1. Identify a place in the program where user input may be used to escalate privileges by for instance accessing unauthorized file system resources through directory browsing.

  2. An attacker realizes that there is a postfix data that gets in the way of getting to the desired resources

  3. An attacker then ads a postfix NULL terminator to the supplied input in order to "swallow" the postfixed data when the insertion is taking place. With the postfix data that got in the way of the attack gone, the doors are opened for accessing the desired resources.

+ Attack Prerequisites

The program does not properly handle postfix NULL terminators

+ Typical Likelihood of Exploit

Likelihood: High

+ Methods of Attack
  • Injection
  • Modification of Resources
  • API Abuse
+ Examples-Instances

Description

Directory Browsing

Assume a Web application allows a user to access a set of reports. The path to the reports directory may be something like web/username/reports. If the username is supplied via a hidden field, an attacker could insert a bogus username such as ../../../../../WINDOWS. If the attacker needs to remove the trailing string /reports, then he can simply insert enough characters so the string is truncated. Alternatively the attacker might apply the postfix NULL character (%00) to determine whether this terminates the string.

Different forms of NULL to think about include

PATH%00
PATH[0x00]
PATH[alternate representation of NULL character]
<script></script>%00

Description

Exploitation of a buffer overflow vulnerability in the ActiveX component packaged with Adobe Systems Inc.'s Acrobat/Acrobat Reader allows remote attackers to execute arbitrary code.

The problem specifically exists upon retrieving a link of the following form:

GET /any_existing_dir/any_existing_pdf.pdf%00[long string] HTTP/1.1

Where [long string] is a malicious crafted long string containing acceptable URI characters. The request must be made to a web server that truncates the request at the null byte (%00), otherwise an invalid file name is specified and a "file not found" page will be returned. Example web servers that truncate the requested URI include Microsoft IIS and Netscape Enterprise. Though the requested URI is truncated for the purposes of locating the file the long string is still passed to the Adobe ActiveX component responsible for rendering the page. This in turn triggers a buffer overflow within RTLHeapFree() allowing for an attacker to overwrite an arbitrary word in memory. The responsible instructions from RTLHeapFree() are shown here:

0x77F83AE5 MOV EAX,[EDI+8]
0x77F83AE8 MOV ECX,[EDI+C]
...
0x77F83AED MOV [ECX],EAX

The register EDI contains a pointer to a user-supplied string. The attacker therefore has control over both the ECX and EAX registers used in the shown MOV instruction.

Successful exploitation allows remote attackers to utilize the arbitrary word overwrite to redirect the flow of control and eventually take control of the affected system. Code execution will occur under the context of the user that instantiated the vulnerable version of Adobe Acrobat.

An attacker does not need to establish a malicious web site as exploitation can occur by adding malicious content to the end of any embedded link and referencing any Microsoft IIS or Netscape Enterprise web server. Clicking on a direct malicious link is also not required as it may be embedded within an IMAGE tag, an IFRAME or an auto-loading script.

Successful exploitation requires that a payload be written such that certain areas of the input are URI acceptable. This includes initial injected instructions as well as certain overwritten addresses. This increases the complexity of successful exploitation. While not trivial, exploitation is definitely plausible [iDefense].

Related Vulnerabilities

CVE-2004-0629

Description

Consider the following PHP script:

$whatever = addslashes($_REQUEST['whatever']);
include("/path/to/program/" . $whatever . "/header.htm");

A malicious attacker might open the following URL, disclosing the boot.ini file:

http://localhost/phpscript.php?whatever=../../../../boot.ini%00
+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Medium

Directory traversal

Skill or Knowledge Level: High

Execution of arbitrary code

+ Solutions and Mitigations

Properly handle the NULL characters supplied as part of user input prior to doing anything with the data.

+ Attack Motivation-Consequences
  • Data Modification
  • Information Leakage
  • Privilege Escalation
  • Run Arbitrary Code
+ Related Weaknesses
CWE-IDWeakness NameWeakness Relationship Type
158Improper Neutralization of Null Byte or NUL CharacterTargeted
172Encoding ErrorTargeted
173Failure to Handle Alternate EncodingTargeted
171Cleansing, Canonicalization, and Comparison ErrorsTargeted
74Failure to Sanitize Data into a Different Plane ('Injection')Targeted
20Improper Input ValidationTargeted
697Insufficient ComparisonTargeted
707Improper Enforcement of Message or Data StructureTargeted
+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern267Leverage Alternate Encoding 
Mechanism of Attack (primary)1000
ChildOfCategoryCategory361WASC Threat Classification 2.0 - WASC-28 - Null Byte Injection 
WASC Threat Classification 2.0333
ParentOfAttack PatternAttack Pattern53Postfix, Null Terminate, and Backslash 
Mechanism of Attack1000
+ Related Security Principles
  • Reluctance to Trust

+ Purposes
  • Penetration
  • Exploitation
+ CIA Impact
Confidentiality Impact: HighIntegrity Impact: HighAvailability Impact: High
+ Technical Context
Architectural Paradigms
All
Frameworks
All
Platforms
All
Languages
All
+ References
G. Hoglund and G. McGraw. "Exploiting Software: How to Break Code". Addison-Wesley. February 2004.
"Adobe Acrobat/Acrobat Reader ActiveX Control Buffer Overflow Vulnerability". iDefense Labs Public Advisory. . <http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=126>.

Bugtraq mailing list archive: PHP Input Validation Vulnerabilities

Available at: http://msgs.securepoint.com/bugtraq/

+ Content History
Submissions
SubmitterOrganizationDate
G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.Cigital, Inc2007-03-01
Modifications
ModifierOrganizationDateComments
Eugene LebanidzeCigital, Inc2007-02-26Fleshed out content to CAPEC schema from the original descriptions in "Exploiting Software"
Sean BarnumCigital, Inc2007-03-05Review and revise
Richard StruseVOXEM, Inc2007-03-26Review and feedback leading to changes in Name, Description and Context Description
Sean BarnumCigital, Inc2007-04-13Modified pattern content according to review and feedback