[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <ded8a9b9-fd84-4744-8704-5d2faf1a9ac2@stbuehler.de>
Date: Wed, 2 Jul 2025 19:01:52 +0200
From: Stefan Bühler <source@...uehler.de>
To: oss-security@...ts.openwall.com
Subject: DoS segfault (NULL pointer deref) in SOPE / SOGo
Hello,
I found a DoS bug in SOPE, the set of Objective-C frameworks powering
SOGo [1].
It is way too easy to trigger with curl:
curl -d 'x=' 'https://.../SOGo/?x='
As far as I can tell all versions since SOGo-2.0.2 (2012-10-29) are
affected.
# Details
I found it inspecting multiple SOGo crashes triggered by someone
hitting URLs like `/OA_HTML/BneViewerXMLService?bne:uueupload=TRUE`
with `POST` that my search engine associates with "Oracle E-Business
Suite (EBS)".
The crash happens in NGHashMap.m line 790 [2], as root->last is NULL:
root->last->next = element;
NGHashMap maps a key to a single-linked list of values.
It turns out `-[NGMutableHashMap addObjects:count:forKey:]` is the
only function maintaining the `root->last` pointer; everything else in
this file doesn't touch it.
The SOPE request handling first parses the POST body for
"formParameters", then clones that NGHashMap (the copied nodes have
`last == NULL`), and then merges the query string parameters into it;
if there is a duplicate key the bug triggers.
I'd like to point out that the linked-list implementation is quite
bad. It wastes memory by using the same struct for the root node
(with count and last metadata) and the member nodes, and seems to
throw exceptions (e.g. when values are nil) but isn't exception
safe (metadata isn't updated consistently).
See attached patch for an attempt to maintain the `last` pointer
properly across all methods; it seems to work for me (on top of
5.8.0-1 in debian/bookworm); submitted to upstream in [4].
In the long run at least the linked-list implementation should
probably be replaced by using some properly tested library.
The `last` handling was introduced in dfceefc 2012-10-15 [3], and I
think it has been broken since then.
(I haven't actually tried to reproduce it with latest upstream, but I
don't think any of the code has been touched in relevant ways.)
cheers,
Stefan
[1] https://www.sogo.nu/
[2] https://github.com/Alinto/sope/blob/3146fbdb6ff3314e37e5c3682deeeef7d0f32064/sope-core/NGExtensions/NGHashMap.m#L790
[3] https://github.com/Alinto/sope/commit/dfceefcb141c1b31b26eea19ca07d3916d663315
[4] https://github.com/Alinto/sope/pull/69
View attachment "0001-NGHashMap-keep-root-last-consistent-to-fix-segfault-.patch" of type "text/x-diff" (5038 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
