SecHash buffer overflow

[szingg]

Hi

I'm trying to configure protected links according to this article: https://www.trustwave.com/Resources/SpiderLabs-Blog/Reducing-web-application-attack-surface/
SecDisableBackendCompression On
SecContentInjection On
SecStreamOutBodyInspection On
SecHashEngine On
SecHashKey rand SessionID
SecHashParam "hmac"
SecHashMethodRx "HashHref" ".(aspx?|php)"

I remarked i also had to set SecResponseBodyAccess On

If i request a page where SecHashMethodRx doesn't match everything works perfect. But as soon the rule is matching i get an "Unhandled exception at 0x72641F2A (ModSecurityIIS.dll) in w3wp.exe: Stack cookie instrumentation code detected a stack-based buffer overrun".

The environment is an embedded installation on IIS. ModSecurity is running on a 32-bit application pool.

Thank you very much.

[zimmerle]

Hi @szingg,

Most likely you have a apr version mismatch. This happens when you compile ModSecurity using a APR version and uses another one during the run time. Do you mind to paste here the first lines of the ModSecurity initialization logs? It contains the versions numbers (compiled and loaded).

[szingg]

Hi @zimmerle

The event log contains following entries:
ModSecurity for IIS (STABLE)/2.9.1 (http://www.modsecurity.org/) configured.
ModSecurity: APR compiled version="1.4.8"; loaded version="1.4.8"
ModSecurity: PCRE compiled version="8.33 "; loaded version="8.33 2013-05-28"
ModSecurity: LUA compiled version="Lua 5.1"
ModSecurity: YAJL compiled version="2.0.1"
ModSecurity: LIBXML compiled version="2.9.1"

[zimmerle]

Hi @szingg,

Did you managed to reproduce the exactly same problem in another computer? Did you compile ModSecurity IIS by yourself?

[szingg]

Hi @zimmerle

Yes I could reproduce the error on another computer (Windows Server 2012 R2 64bit).
It turned out, Windows only crashes if application pool option enable32BitAppOnWin64 is set true. On false an error is written to event log 'ModSecurity: inject_hashed_response_body: Unable to inject hash into response body. Returning response without changes. '
It seems to be the same bug reported in #742

[parthasarathi204]

The issue is due to buffer overflow of msc_crypt.c # hmac() function.
char *hmac(modsec_rec *msr, const char *key, int key_len, unsigned char *msg, int msglen) {
..........................
..........................
char hex_digest[APR_SHA1_DIGESTSIZE * 2]
hmac_digest = hex_digest;
for (i = 0; i < sizeof (digest); i++) {
*hmac_digest++ = hex[digest[i] >> 4];
*hmac_digest++ = hex[digest[i] & 0xF];
}
*hmac_digest = '\0';
...........................
...........................
}

There is no memory to copy '\0' in hex_digest. Due to that apr_pstrdup () crashes . To fix the issue, hex_digest buffer should be increased to hex_digest[APR_SHA1_DIGESTSIZE * 2 + 1]
patch as follows.

--- a/apache2/msc_crypt.c
+++ b/apache2/msc_crypt.c

- char hex_digest[APR_SHA1_DIGESTSIZE * 2], *hmac_digest;
+ char hex_digest[APR_SHA1_DIGESTSIZE * 2 + 1], *hmac_digest;