[FD] [0day-rubbish] NoMachine Terminal Server 10.0.57 two vulnerabilities

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing two vulnerabilities in 
NoMachine Terminal Server 10.0.57.

Vulnerability 1 — Pre-authentication heap memory corruption (out-of-bounds 
write to double-free) (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 
CWE-787)

NoMachine Terminal Server is a closed-source remote-desktop gateway used by 
enterprises to deliver virtual desktops and remote sessions over HTTPS. The 
nxwebrunner CGI RequestCollector::parsePOST contains an unbounded quote-scan 
loop and an unbounded name-copy loop; a single unauthenticated 
multipart/form-data POST with a filename attribute reads past the body 
terminator and overflows heap chunk metadata. The cleanup path frees the 
corrupted chunk, producing a double-free abort and an RCE-capable heap-overflow 
primitive (verified: 9/10 trigger requests crashed).

Authentication: unauthenticated / pre-auth

Vulnerability 2 — Pre-authentication stack buffer overflow with return-address 
control (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-787)

In the same nxwebrunner CGI, RequestCollector::parsePOST copies 
attacker-controlled multipart name and value fields and then executes 
sprintf(stack_buf, "%s=%s&", name, value) into a 1032-byte stack buffer. When 
name + value + 2 exceeds 1032, the write overwrites saved registers and the 
return address. The binary is non-PIE with stack canaries disabled, so the 
attacker controls the return address (verified in core dumps); stable RCE 
currently requires a leak primitive, but the pre-auth crash is deterministic.

Authentication: unauthenticated / pre-auth

Full technical analyses and reproducible proofs-of-concept:
  
https://0day-rubbish.com/blog/nomachine-terminal-server-preauth-heap-corruption
  https://0day-rubbish.com/blog/nomachine-terminal-server-preauth-stack-overflow

Project archive (ongoing disclosure series):
  https://github.com/Exploit-Garbage/0day-Rubbish

Vendor has been notified. CVE IDs are pending.

--
0day Rubbish Research Team
disclosure@xxxxxxxxxxxxxxxx
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/