iptime NAS Buffer Overflow Vulnerability in upload.cgi Pre-Authentication

A buffer overflow vulnerability has been identified in the upload.cgi module of iptime NAS firmware version 1.5.04. This vulnerability is caused by the unsafe use of the strcpy function, which copies data from the CONTENT_TYPE HTTP header into a fixed-size stack buffer of 8 bytes, without proper bounds checking. The issue arises before authentication is processed, making it exploitable pre-authentication.

Impact

Exploitation of this vulnerability allows for a buffer overflow, where the attacker can overwrite the stack and potentially gain control of the execution flow, as demonstrated in a proof-of-concept.

Reproduction

The vulnerability can be reproduced by sending an HTTP request to the upload.cgi script with a CONTENT_TYPE header that includes a payload of 5000 'A' characters. This can be done using a QEMU simulation that mimics the vulnerable environment.