RoyalTSX 6.0.1 – RTSZ File Handling Heap Memory Corruption PoC
RoyalTSX 6.0.1 RTSZ File Handling Heap Memory Corruption PoC Vendor: Royal Apps GmbH Web page: https://www.royalapps.com Affected version: 6.0.1.1000 (macOS) Summary: Royal TS is an ideal tool for system engineers and other IT professionals who need remote access to systems with different protocols. Not only easy to use, it enables secure multi-user document sharing. Desc: The application receives SIGABRT after RAPortCheck.createNWConnection() function is handling the SecureGatewayHost object in the RoyalTSXNativeUI. When the hostname has an array of around 1600 bytes and Test Connection is clicked the app crashes instantly. Tested on: MacOS 13.5.1 (Ventura) Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2023-5788 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5788.php 05.09.2023 -- ------------------------------------- Translated Report (Full Report Below) ------------------------------------- Process: RoyalTSX [23807] Path: /Applications/Royal TSX.app/Contents/MacOS/RoyalTSX Identifier: com.lemonmojo.RoyalTSX.App Version: 6.0.1 (6.0.1.1000) Code Type: X86-64 (Native) Parent Process: launchd [1] User ID: 503 Date/Time: 2023-09-05 16:09:46.6361 +0200 OS Version: macOS 13.5.1 (22G90) Report Version: 12 Bridge OS Version: 7.6 (20P6072) Time Awake Since Boot: 21000 seconds Time Since Wake: 1106 seconds System Integrity Protection: enabled Crashed Thread: 0 tid_103 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGABRT) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000050 Exception Codes: 0x0000000000000001, 0x0000000000000050 Termination Reason: Namespace SIGNAL, Code 6 Abort trap: 6 Terminating Process: RoyalTSX [23807] VM Region Info: 0x50 is not in any region. Bytes before following region: 140737488273328 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL UNUSED SPACE AT START ---> shared memory 7ffffffec000-7ffffffed000 [ 4K] r-x/r-x SM=SHM Application Specific Information: abort() called Thread 0 Crashed:: tid_103 Dispatch queue: com.apple.main-thread 0 libsystem_kernel.dylib 0x7ff809ef7202 __pthread_kill + 10 1 libsystem_pthread.dylib 0x7ff809f2eee6 pthread_kill + 263 2 libsystem_c.dylib 0x7ff809e55b45 abort + 123 3 libmonosgen-2.0.1.dylib 0x1028daa1b altstack_handle_and_restore + 235 4 libmonosgen-2.0.1.dylib 0x102879db6 summarize_frame_internal + 310 5 libmonosgen-2.0.1.dylib 0x102879f66 summarize_frame + 198 6 libmonosgen-2.0.1.dylib 0x10287578f mono_walk_stack_full + 1135 7 libmonosgen-2.0.1.dylib 0x102873944 mono_summarize_managed_stack + 100 8 libmonosgen-2.0.1.dylib 0x102a0f478 mono_threads_summarize_execute_internal + 1256 9 libmonosgen-2.0.1.dylib 0x102a0f8aa mono_threads_summarize + 346 10 libmonosgen-2.0.1.dylib 0x1028e0b67 mono_dump_native_crash_info + 855 11 libmonosgen-2.0.1.dylib 0x10287864e mono_handle_native_crash + 318 12 libmonosgen-2.0.1.dylib 0x1027d1966 mono_crashing_signal_handler + 86 13 libsystem_platform.dylib 0x7ff809f5c5ed _sigtramp + 29 14 ??? 0x101e9502c ??? 15 RoyalTSXNativeUI 0x109e50012 RAPortCheck.createNWConnection() + 290 16 RoyalTSXNativeUI 0x109e4f6d2 RAPortCheck.connect() + 242 17 RoyalTSXNativeUI 0x10a021c70 static RASecureGatewayPropertyPageHelper.testConnection(hostname:port:logger:localizer:parentWindow:progressIndicator:testConnectionButton:) + 592 18 RoyalTSXNativeUI 0x10a0b94e7 RAPropertyPageSecureGatewayMain.testConnection() + 359 19 RoyalTSXNativeUI 0x10a0b9573 @objc RAPropertyPageSecureGatewayMain.buttonTestConnection_action(_:) + 51 20 AppKit 0x7ff80d29742c -[NSApplication(NSResponder) sendAction:to:from:] + 323 21 AppKit 0x7ff80d2972b0 -[NSControl sendAction:to:] + 86 22 AppKit 0x7ff80d2971e2 __26-[NSCell _sendActionFrom:]_block_invoke + 131 23 AppKit 0x7ff80d2970eb -[NSCell _sendActionFrom:] + 171 24 AppKit 0x7ff80d297031 -[NSButtonCell _sendActionFrom:] + 96 25 AppKit 0x7ff80d293ee5 NSControlTrackMouse + 1816 26 AppKit 0x7ff80d2937a9 -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 121 27 AppKit 0x7ff80d29367c -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] + 606 28 AppKit 0x7ff80d292ac0 -[NSControl mouseDown:] + 659 29 AppKit 0x7ff80d290f9d -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:] + 4330 30 AppKit 0x7ff80d2087d7 -[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:] + 404 31 AppKit 0x7ff80d208427 -[NSWindow(NSEventRouting) sendEvent:] + 345 32 AppKit 0x7ff80d206e01 -[NSApplication(NSEvent) sendEvent:] + 345 33 AppKit 0x7ff80d3413ae -[NSApplication _doModalLoop:peek:] + 360 34 AppKit 0x7ff80d4c2219 __33-[NSApplication runModalSession:]_block_invoke_2 + 69 35 AppKit 0x7ff80d4c21c1 __33-[NSApplication runModalSession:]_block_invoke + 78 36 AppKit 0x7ff80d33f773 _NSTryRunModal + 100 37 AppKit 0x7ff80d4c20be -[NSApplication runModalSession:] + 128 38 RoyalTSXNativeUI 0x109f17044 RAPropertiesWindowController._showModal() + 628 39 RoyalTSXNativeUI 0x109f17548 @objc RAPropertiesWindowController._showModal() + 24 40 Foundation 0x7ff80ae84951 -[NSObject(NSThreadPerformAdditions) performSelector:onThread:withObject:waitUntilDone:modes:] + 379 41 Foundation 0x7ff80ae84676 -[NSObject(NSThreadPerformAdditions) performSelectorOnMainThread:withObject:waitUntilDone:] + 124 42 libffi.dylib 0x7ff81a5fd8c2 ffi_call_unix64 + 82 43 libffi.dylib 0x7ff81a5fd214 ffi_call_int + 830 Thread 0 crashed with X86 Thread State (64-bit): rax: 0x0000000000000000 rbx: 0x00007ff84d608700 rcx: 0x00007ff7be10fbc8 rdx: 0x0000000000000000 rdi: 0x0000000000000103 rsi: 0x0000000000000006 rbp: 0x00007ff7be10fbf0 rsp: 0x00007ff7be10fbc8 r8: 0x0000000000000212 r9: 0x00007fafaeaf64a8 r10: 0x0000000000000000 r11: 0x0000000000000246 r12: 0x0000000000000103 r13: 0x00007ff7be110418 r14: 0x0000000000000006 r15: 0x0000000000000016 rip: 0x00007ff809ef7202 rfl: 0x0000000000000246 cr2: 0x00007ff84d611068 Logical CPU: 0 Error Code: 0x02000148 Trap Number: 133 Thread 0 instruction stream: 0f 84 24 01 00 00 49 8b-79 08 4c 89 45 c0 89 4d ..$...I.y.L.E..M d4 48 89 55 c8 4d 89 cc-e8 5d 79 0e 00 48 89 c3 .H.U.M...]y..H.. 4b 8d 7c 3e 04 48 8b 73-30 ba 8c 00 00 00 e8 07 K.|>.H.s0....... 7f 25 00 4c 8b 45 c0 48-8b 43 58 4b 89 84 3e a0 .%.L.E.H.CXK..>. 00 00 00 41 8b 44 24 04-43 89 84 3e 90 00 00 00 ...A.D$.C..>.... 48 8b 43 38 4b 89 84 3e-a8 00 00 00 48 8b 43 60 H.C8K..>....H.C` [8b]40 50 43 89 84 3e b0-00 00 00 8b 43 40 43 89 .@PC..>.....C@C. <== 84 3e b4 00 00 00 48 8b-45 c8 43 89 84 3e 98 00 .>....H.E.C..>.. 00 00 8b 45 d4 43 89 84-3e 94 00 00 00 eb 18 48 ...E.C..>......H 8d 05 80 ff 26 00 e9 96-00 00 00 43 c7 84 3e 90 ....&......C..>. 00 00 00 ff ff ff ff 49-8b 45 10 48 8b 18 41 83 .......I.E.H..A. 38 00 74 24 4b 8d 7c 3e-04 4d 89 c4 e8 69 d8 14 8.t$K.|>.M...i.. Binary Images: 0x101deb000 - 0x101df6fff com.lemonmojo.RoyalTSX.App (6.0.1) <328845a4-2e68-3c0f-a495-033ac725bb43> /Applications/Royal TSX.app/Contents/MacOS/RoyalTSX ... ... |