Buffer Overflow in webfsd 1.21 via Malicious Filename Request

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2025-70314 is a buffer overflow vulnerability in webfsd version 1.21, a simple HTTP server. It occurs because the server uses a fixed-size stack buffer named "filename" to store the requested URI without properly checking the length of the input. When a specially crafted HTTP request with an excessively long URI is sent, it causes the server to write beyond the buffer\'s boundary, leading to a stack-buffer-overflow.'}, {'type': 'paragraph', 'content': 'This vulnerability can be triggered remotely by an unauthenticated attacker simply by sending a maliciously long HTTP request URI, causing the server to crash.'}] [2]

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a remote Denial of Service (DoS). An attacker can crash the webfsd server by sending a crafted HTTP request with an excessively long URI, causing the server process to abort due to the buffer overflow.

Because the vulnerability does not require authentication or filesystem access, it allows an attacker to disrupt service availability remotely and without privileges.

The CVSS v3.1 base score of 9.8 reflects the high severity, indicating critical impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending an HTTP request with an excessively long URI to the webfsd server and observing if the server crashes or reports a stack-buffer-overflow error.'}, {'type': 'paragraph', 'content': "To reproduce or detect the issue, you can use tools like curl or netcat to send a crafted HTTP request with a very long URI string (e.g., 2040 'A' characters) to the server's listening port."}, {'type': 'list_item', 'content': 'Example command using curl to send a long URI: curl "http://target-server:8000/$(python3 -c \'print("A"*2040)\')"'}, {'type': 'list_item', 'content': 'Alternatively, use netcat to manually send a crafted HTTP GET request with a long URI.'}, {'type': 'paragraph', 'content': 'If the server crashes or logs a stack-buffer-overflow error (especially when compiled with sanitizers), it indicates the presence of the vulnerability.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enforcing a strict maximum length for the HTTP request URI/path on the server side and rejecting any requests that exceed this limit.

Additionally, replacing unsafe buffer operations with bounded functions like snprintf and adding explicit bounds checks in all code paths that handle the filename buffer are recommended.

If possible, upgrade to a version of webfsd later than 1.21 where this vulnerability is fixed or apply patches that address the buffer overflow.

As a temporary measure, consider restricting access to the webfsd server from untrusted networks to reduce exposure.

Useful 0 Not Useful 0