Flexsense DiskBoss Local Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

A local buffer overflow vulnerability has been identified in Flexsense DiskBoss version 7.7.14, specifically within the 'Input Directory' component. This vulnerability allows unauthenticated attackers to execute arbitrary code on the system. Exploitation involves pasting a specially crafted directory path into the 'Add Input Directory' field.

Impact

Exploitation of this vulnerability leads to a local buffer overflow, allowing for arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by turning off Data Execution Prevention (DEP) for the DiskBoss application. After that, the 'Add Input Directory' feature can be accessed, where the crafted payload is pasted into the directory field. Once confirmed, the injected code is executed, demonstrated by the launch of 'calc.exe'.