Command Injection Vulnerability in KiTTY Get Remote File Through SCP Input (CVE-2024-23749)

2024-2-14 10:16:29 Author: seclists.org(查看原文) 阅读量:21 收藏

Austin A. DeFrancesco (DEFCESCO) discovered a command injection vulnerability in KiTTY 
(https://github.com/cyd01/KiTTY/). This vulnerability:

-   Is exploitable by any KiTTY user connecting to a host with the embedded exploit;
-   The vulnerability was introduced in the original release in May 2021 (commit 4f79b1e) and affects all versions up 
to KiTTY ≤ 0.76.1.13 in their default configuration.

Austin developed an exploit for this vulnerability and obtained remote code execution in the context of the user 
running the application; by default, KiTTY can be operated in the user permission group of Standard Users. This exploit 
is stable and repeatable on all Microsoft Windows operating systems 11/10/8/7/XP.

Analysis:
---------

CVE-2024-23749 command injection vulnerability is in `kitty.c` precisely the `GetOneFile` function. The vulnerable 
lines of code are on lines `2369-2386`; in the latest revision `75fa2abcd220c172` 
(https://github.com/cyd01/KiTTY/blob/75fa2abcd220c17249ff7252f8d5224137001f2d/kitty.c#L2369C4-L2391C2).

If KiTTY encounters the ANSI escape sequence `\\033]0;__rv` in a stream, it interprets it as an instruction to transfer 
files using Putty Secure Copy Protocol (PSCP):

-   `\\033`: This is the escape character (octal representation of ASCII ESC), which signals the beginning of an escape 
sequence.
-   `]0;`: This sequence part indicates a metacommand will be defined.
-   `__rv`: This is the vulnerable KiTTY command to transfer files using PSCP, which takes the input of a filename or 
file path.
-   `\\077`: This is the terminator sequence to indicate the end of the escape sequence.
-   KiTTY’s `kitty.c` `__rv` command runs through specific handling based on the input parameters and configurations.

After the series of specific handling requests for other input parameters and configurations (at lines 2277-2368), 
KiTTY checks if the `filename` is larger than zero and checks if the `filename` is a directory or a single filename (at 
lines 2372). After these parameter and configuration checks, the filename is concatenated to the `buffer` (at line 
2377). Finally, the constructed buffer is executed using the `system( buffer )` (at line 2386).

CVE-2024-24749, where the `filename` variable is vulnerable to command injection, occurs due to insufficient input 
sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This 
allows an attacker to add inputs inside the `filename` variable, leading to arbitrary code execution.

2369 if( filename[0]=='/' ) { 2370 strcat(buffer, filename ) ; 2371 } else { 2372 if( (directory!=NULL) && 
(strlen(directory)>0) && (strlen(filename)>0) ) { 2373 strcat( buffer, directory ) ; strcat( buffer, "/" ) ; strcat( 
buffer, filename ) ; 2374 } else if( (directory!=NULL) && (strlen(directory)>0) ) { 2375 strcat(buffer, directory ) ; 
strcat( buffer, "/*") ; 2376 } else { 2377 strcat(buffer, filename ) ; 2378 } 2379 } 2380 strcat( buffer, "\" \"" ) ; 
strcat( buffer, dir ) ; strcat( buffer, "\"" ) ; 2381 //strcat( buffer, " > kitty.log 2>&1" ) ; //if( !system( buffer ) 
) unlink( "kitty.log" ) ; 2382 2383 chdir( InitialDirectory ) ; 2384 2385 if( debug_flag ) { debug_logevent( "Get on 
file: %s", buffer) ; } 2386 if( system( buffer ) ) { MessageBox( NULL, buffer, "Transfer problem", MB_OK|MB_ICONERROR ) 
; } 2387 2388 //debug_log("%s\n",buffer);//MessageBox( NULL, buffer, "Info",MB_OK ); 2389 2390 
memset(buffer,0,strlen(buffer)); 2391 }

Exploitation:
-------------

### __rv Command Injection:

Full Disclosure mailing list archives

Current thread: