FlashFXP 5.3.0 Memory Corruption
Posted on 13 June 2016
Document Title: =============== FlashFXP v5.3.0 (Windows) - Memory Corruption Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1853 Release Date: ============= 2016-06-13 Vulnerability Laboratory ID (VL-ID): ==================================== 1853 Common Vulnerability Scoring System: ==================================== 5.1 Product & Service Introduction: =============================== FlashFXP is a FTP, FTPS, SFTP client for Windows. Secure, reliable, and efficient file transfers. Use FlashFXP to publish and maintain your website. Upload and download files, such as documents, photos, videos, music and more! Transfer or backup local and remote files, plus (FXP) server to server ftp transfers. FlashFXP offers unique and complimentary advanced features for client configuration. Share files with your friends and co-workers (FTP or SFTP server required). (Copy of the Homepage: https://www.flashfxp.com/ ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a local memory corruption vulnerability in the official FlashFXP v5.3.0 windows software. Vulnerability Disclosure Timeline: ================================== 2016-06-01: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH) 2016-06-02: Vendor Notification (FlashFXP Security Team) 2016-**-**: Vendor Fix/Patch (FlashFXP Security Team) 2016-06-13: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== OpenSight Software Product: FlashFXP - Software (Client) [Windows] 5.3.0 (Build 3932) Exploitation Technique: ======================= Local Severity Level: =============== Medium Technical Details & Description: ================================ A local memory corruption vulnerability has been discovered in the official FlashFXP v5.3.0 windows software. The vulnerability allows local attackers to compromise the software process by exploitation of a memory issue. The vulnerability is located in the `Move file in queue` input function of the `Tools - Schedule - Plan` module. The input of the `Move file in queue` function is able to compromise the `Tools - Schedule - Plan` module after successful exploitation. The `Move file in queue` function has no memory limitation on request only the regular exception-handling. Thus results in a unexpected out of memory exception were the attacker can continue to process the input. The error is saved into the new generated bug report because of the uncaught unknown exception. The issue can be trigged automatically by a stable included scheduled plan to compromise or crash the process. The security risk of the vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 5.1. Exploitation of the vulnerability requires a low privileged or restricted system user account without user interaction. Successful exploitation of the vulnerability results in unknown exceptions, software process crashs and process compromise. Vulnerable Module(s): [+] Tools - Schedule - Plans Vulnerable Input(s): [+] Move file in queue Proof of Concept (PoC): ======================= The memory corruption issue can be exploited by local attackers with low privileged system user account and without user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Install the newst flashfpx software version to your windows computer 2. Open the software process with the interface 3. Click on top to tools menu on top of the bar 4. Open the schedule a plan option 5. Add a new plan to the schedule list module 6. Include to the in the `Move file in queue` input field a large unicode string as payload to exploit 7. Save the entry and start the plan (right mouse click or push enter in the mask) Note: Now the plan is processing the move file in queue input 8. An exception occurs that shows the error message "Out of Memory" (Memory Corruption) Note: The exception returns all the time and the software is crashed by a memory corruption 9. Close the software and start the process again to approve the application-side attack vector 10. Open the tools and switch to the schedule option 11. The software crashs permanently with the save plan by an error exception Note: The input has been saved since the corruption occurs and is stored! 12. Successful reproduce of the vulnerability! --- Exception Handling Bug Report Records --- date/time : 2016-05-31, 19:16:47 computer name : X01 Session 2016 user name : Benjamin Kunz Mejri operating system : Windows 10 x64 build 10586 processors : 4x Intel(R) Core(TM) i5-4210M CPU @ 2.60GHz process id : $354 allocated memory : 2,92 GB largest free block : 222,84 MB executable : FlashFXP.exe exec. date/time : 2016-05-06 18:23 executable hash : 08CFB10FC665C75047FE895D7517973D version : 5.3.0.3932 SSE2 : 1 WinOSCompatMode : 0 ID : b07af5b3110aa75f4bd313454fd40c49 Install Mode : Per User - User data folder AppFolder : C:Program Files (x86)FlashFXP 5 DataFolder : C:UsersAdminAppDataRoamingFlashFXP5 TempFolder : C:UsersAdminAppDataLocalTemp Themes Available : 1 Themes Active : 1 App Instance Count : 1 ANSI code page : 1252 Thread locale : 1031 User Default Locale : 1031 PixelsPerInch : 96 ScreenReader : 0 PrevBuild : 0 MouseOverCtrl : TQueueStorage.Queue Active Form : TFrmTskSchd (FrmTskSchd) Forms : TFrmTskSchd, TFrmMain, TTntForm Active Ctrl : TPTListView (LV) APPE : 0 WideChar Test : 0 callstack crc : $8fd89c21, $956cbda8, $15fea25c exception number : 1 exception class : EOutOfMemory exception message : Out of memory. Note: The report is generated by the process via software exception-handling --- Vulnerable Process Log --- 00920000 FlashFXP.exe - 5.3.0.3932 - C:Program Files (x86)FlashFXP 5 --- CPU Registers Log --- eax = 02fb1b50 ebx = 009ad6dd ecx = cc5bedf0 edx = 009ad6dd esi = 009ad6dd edi = 005fdc34 eip = 009ad6dd esp = 005fdbc8 ebp = 005fdc4c --- Stack Dump Log --- 005fdbc8 dd d6 9a 00 de fa ed 0e - 01 00 00 00 07 00 00 00 ................ 005fdbd8 dc db 5f 00 dd d6 9a 00 - 50 1b fb 02 dd d6 9a 00 .._.....P....... 005fdbe8 dd d6 9a 00 34 dc 5f 00 - 4c dc 5f 00 f8 db 5f 00 ....4._.L._..._. 005fdbf8 01 00 00 00 dc 17 92 00 - 04 00 00 00 30 b6 eb 02 ............0... 005fdc08 dd d6 9a 00 05 00 00 00 - 2c e4 5f 00 f8 3e c4 00 ........,._..>.. 005fdc18 fa 55 c4 00 74 dc 5f 00 - f8 32 92 00 4c dc 5f 00 .U..t._..2..L._. 005fdc28 6c de 5f 00 6c de 5f 00 - 40 3e 8a 05 00 00 00 00 l._.l._.@>...... 005fdc38 00 00 00 00 00 00 00 00 - 00 00 00 00 6c de 5f 00 ............l._. 005fdc48 40 3e 8a 05 a4 dd 5f 00 - 70 b6 c5 00 7c dc 5f 00 @>...._.p...|._. 005fdc58 00 00 00 00 6c de 5f 00 - 40 3e 8a 05 4e bc 00 00 ....l._.@>..N... 005fdc68 6c de 5f 00 40 3e 8a 05 - 29 da b6 00 e4 dd 5f 00 l._.@>..)....._. 005fdc78 37 34 92 00 a4 dd 5f 00 - 4e bc 00 00 6c de 5f 00 74...._.N...l._. 005fdc88 40 3e 8a 05 00 00 00 00 - c0 b6 33 01 00 00 00 00 @>........3..... 005fdc98 ac 47 78 75 fd 0b 01 c5 - da 01 00 00 1a 00 00 00 .Gxu............ 005fdca8 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 005fdcb8 00 00 00 00 e8 03 00 00 - 00 00 00 00 ff ff ff ff ................ 005fdcc8 00 00 00 00 00 00 00 00 - c0 fa 2d 01 20 dd 5f 00 ..........-. ._. 005fdcd8 05 00 00 00 ff ff ff ff - c0 b6 33 01 00 00 00 00 ..........3..... 005fdce8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 005fdcf8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ --- Disassembler Log --- [...] 00c5b648 jmp loc_c5b6a9 00c5b648 00c5b648 ; --------------------------------------------------------- 00c5b648 00c5b64a loc_c5b64a: 00c5b64a 1396 cmp word ptr [ebx+$3ca], 0 00c5b652 jz loc_c5b667 00c5b652 00c5b654 1397 lea ecx, [edx+$c] 00c5b657 mov edx, ebx 00c5b659 mov eax, [ebx+$3cc] 00c5b65f call dword ptr [ebx+$3c8] 00c5b65f 00c5b665 jmp loc_c5b6b2 00c5b665 00c5b665 ; --------------------------------------------------------- 00c5b665 00c5b667 loc_c5b667: 00c5b667 1400 mov edx, edi 00c5b669 mov eax, ebx 00c5b66b > call -$1628c ($c453e4) ; TntComCtrls.TTntCustomListView.CNNotify 00c5b66b 00c5b670 jmp loc_c5b6b2 00c5b670 00c5b670 ; --------------------------------------------------------- 00c5b670 00c5b672 loc_c5b672: 00c5b672 1411 cmp word ptr [ebx+$482], 0 00c5b67a jz loc_c5b69e 00c5b67a 00c5b67c 1413 push esp 00c5b67d call -$333d1e ($927964) ; Windows.GetCursorPos 00c5b67d 00c5b682 1414 lea ecx, [esp+8] 00c5b686 mov edx, esp 00c5b688 mov eax, ebx 00c5b68a call -$ef6eb ($b6bfa4) ; Controls.TControl.ScreenToClient 00c5b68a 00c5b68f lea edx, [esp+8] 00c5b693 mov eax, ebx 00c5b695 mov si, $ffaa [...] Solution - Fix & Patch: ======================= The vulnerability can be patched by an allocate of the memory or limitation and restriction of the vulnerable input fields. Disallow to continue the process input via debugger to prevent exploitation of the memory corruption issue. Security Risk: ============== The security risk of the local memory corruption vulnerability in the schedule plan module of the software is estimated as medium. (CVSS 5.1) Credits & Authors: ================== Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (research@vulnerability-lab.com) [http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com Section: magazine.vulnerability-lab.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@vulnerability-lab.com) to get a ask permission. Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com CONTACT: research@vulnerability-lab.com
