RabidHamster R4 File Disclosure and Buffer Overflow Vulnerabilities
Description
Luigi Auriemma has discovered multiple vulnerabilities in RabidHamster R4, which can be exploited by malicious people to disclose potentially sensitive information and compromise a vulnerable system.
1) A boundary error when creating a log entry can be exploited to cause a stack-based buffer overflow via an overly long web request sent to TCP port 8888.
2) A boundary error when processing a web request can be exploited to cause a heap-based buffer overflow via an overly long request sent to TCP port 8888.
3) Input passed to the "cmd" parameter in left_console.html via the "loadfile()" script function is not properly verified before being used to read files and can be exploited to disclose arbitrary files via directory traversal attacks.
4) A boundary error when processing the "miniscreenshot" script function can be exploited to cause a stack-based buffer overflow via an overly long parameter sent in a web request to TCP port 8888.
Successful exploitation of vulnerabilities #1, #2, and #4 allows execution of arbitrary code, but requires the "Network Access" option to be enabled (disabled by default).
The vulnerabilities are confirmed in version 1.25. Other versions may also be affected.
