提交 #894188: D-Link DSM-G600 REVA 1.01 Buffer Overflow / Out-of-bounds Write candidate

D-Link DSM-G600 load_file.cgi authenticated multipart memory corruption

## 2. Vulnerability Summary

- **Internal Tracking ID:** DLINK-BOF-001
- **Vulnerability Class:** CWE-120 / CWE-787
- **Vulnerability Type:** Buffer Overflow / Out-of-bounds Write candidate
- **Severity:** 6.5 (Medium)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- **Attack Prerequisites:** Authenticated web-management access required
- **Verification Status:** CONFIRMED
- **Verification Evidence:** runtime/QEMU marker evidence + duplicate checks in D-Link evidence package

## 3. Affected Vendor / Product

- **Vendor:** D-Link
- **Product:** DSM-G600 REVA
- **Affected Version / Firmware:** 1.01
- **Affected Component:** load_file.cgi multipart handler
- **Architecture:** ARM big-endian

## 4. Description

The DSM-G600 embedded HTTP daemon crashes while handling an authenticated multipart POST to `load_file.cgi`, the configuration-restore endpoint used by the Tools/System page. In the restored firmware rootfs under `qemu-armeb-static`, multipart bodies of approximately 8192 bytes or larger reproducibly terminate the target process with SIGSEGV.

The crash is endpoint-specific in the current evidence. Comparable long multipart uploads to `update.cgi` did not crash the daemon, and unauthenticated or bad-auth `load_file.cgi` probes were rejected or reset without terminating the process. The affected request therefore appears to require access to the management interface. The tested credential was `admin:` because DSM-family devices commonly shipped with an empty default admin password; default-credential exposure should be handled separately from this memory-corruption finding.

## 5. Technical Details

Stable SIGSEGV cases from the focused matrix:

| Case | Auth | Payload Length | Result |
| ------------------------------------------ | -------- | -------------- | -------------- |
| `post_load_file_admin_empty_8192` | `admin:` | 8192 bytes | target SIGSEGV |
| `post_load_file_admin_empty_12000` | `admin:` | 12000 bytes | target SIGSEGV |
| `post_load_file_admin_empty_20000` | `admin:` | 20000 bytes | target SIGSEGV |
| `post_load_file_admin_empty_field_x_12000` | `admin:` | 12000 bytes | target SIGSEGV |

Negative controls:

| Case Group | Result |
| ------------------------------------------------------------ | -------------------------- |
| `GET /` without auth | 401, process remains alive |
| `GET /load_file.cgi` without auth | 401, process remains alive |
| `POST /load_file.cgi` without auth | no SIGSEGV observed |
| `POST /load_file.cgi` with bad auth | no SIGSEGV observed |
| `POST /load_file.cgi` with `admin:` and 128/1024/4096 byte body | no SIGSEGV observed |
| `POST /update.cgi` with `admin:` and 12000 byte body | no SIGSEGV observed |

Boundary summary:

| Dimension | Observation |
| -------------------- | ------------------------------------------------------------ |
| Authentication | SIGSEGV reproduced only after successful `admin:` authentication in this matrix |
| Endpoint | `load_file.cgi` crashes; `update.cgi` with comparable body does not |
| Body length | 4096 bytes and below did not crash; 8192 bytes and above crashed |
| Multipart field name | Both `file` and `x` triggered SIGSEGV at 12000 bytes after authentication |

Representative runtime signal:

```text
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
```

## 6. Proof of Concept / Reproduction

Minimal request shape:

```http
POST /load_file.cgi HTTP/1.0
Host: <TARGET>
Authorization: Basic YWRtaW46
Content-Type: multipart/form-data; boundary=firmrec
Content-Length: <calculated>

--firmrec
Content-Disposition: form-data; name="file"; filename="x.bin"
Content-Type: application/octet-stream

<8192 or more bytes>
--firmrec--
```

The focused local reproduction script builds this request automatically:

```bash
python3 scripts/oneoff/verify_dsmg600_loadfile_crash_20260526.py
```

A minimal network-only PoC is also available for a live target or lab instance:

```bash
python3 scripts/oneoff/poc_dsmg600_loadfile_crash_20260526.py <target-ip> --user admin --password '' --size 12000
```

## 7. Security Impact

An authenticated network attacker can crash the DSM-G600 HTTP management daemon, causing denial of service for the administrative interface. Because the crash is a target SIGSEGV in the HTTP process during multipart parsing or restore handling, exploitability beyond denial of service needs additional reverse-engineering before claiming code execution.

## 8. Remediation Recommendation

1. Add strict multipart upload size limits before buffering or parsing restore files.
2. Validate multipart boundaries, field names, and file lengths before copying into fixed-size buffers.
3. Reject malformed restore files before invoking restore/reboot logic.
4. Add regression tests for oversized configuration uploads.

## 9. Discovery / Verification

- **Discovery Method:** FirmRec + focused runtime verification + public duplicate checks
- **Submission Pack Date:** 2026-07-07
- **Source Report:** `docs/vulndb_submissions/DLINK-BOF-001.md`
- **Final Curation Decision:** included as confirmed / submit-ready for VulnDB.

## 10. Disclosure Timeline

| Date | Event |
| ---- | ---------------------------------- |
| TBD | Vendor notification / coordination |
| TBD | CVE/VulnDB assignment |
| TBD | Public disclosure |

## 11. Source Report / Full Original Material

> The following source content is preserved for traceability. The normalized fields above are the VulnDB form fields to submit.

## Basic Information

| Field | Value |
| ------------------ | -------------------------------------------------------- |
| VulnDB ID | Pending assignment |
| CVE ID | Pending assignment |
| CWE ID | CWE-120 / CWE-787 candidate |
| CVSS v3.1 Score | 6.5 |
| CVSS v3.1 Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Vulnerability Type | Authenticated HTTP memory corruption / denial of service |
| Internal ID | DLINK-BOF-001 |

## Affected Product

| Field | Value |
| -------------------------- | --------------------------------------------- |
| Vendor | D-Link |
| Product | DSM-G600 Wireless Network Storage Enclosure |
| Confirmed Firmware Version | REVA 1.01 |
| Confirmed Firmware Image | `dlink-DSM__DSM-G600_REVA_FIRMWARE_1.01.ZIP` |
| Affected Binary | `e_storage/bin/http` |
| Web Endpoint | `/load_file.cgi` |
| Architecture | ARM big-endian |
| Confirmed Binary SHA1 | `b1294640f6899db7d6e2f5600a273224889d1a9e` |
| Authentication | Required; reproduced with HTTP Basic `admin:` |

## Description

The DSM-G600 embedded HTTP daemon crashes while handling an authenticated multipart POST to `load_file.cgi`, the configuration-restore endpoint used by the Tools/System page. In the restored firmware rootfs under `qemu-armeb-static`, multipart bodies of approximately 8192 bytes or larger reproducibly terminate the target process with SIGSEGV.

The crash is endpoint-specific in the current evidence. Comparable long multipart uploads to `update.cgi` did not crash the daemon, and unauthenticated or bad-auth `load_file.cgi` probes were rejected or reset without terminating the process. The affected request therefore appears to require access to the management interface. The tested credential was `admin:` because DSM-family devices commonly shipped with an empty default admin password; default-credential exposure should be handled separately from this memory-corruption finding.

## Impact

An authenticated network attacker can crash the DSM-G600 HTTP management daemon, causing denial of service for the administrative interface. Because the crash is a target SIGSEGV in the HTTP process during multipart parsing or restore handling, exploitability beyond denial of service needs additional reverse-engineering before claiming code execution.

• 来源: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-BOF-001-vulndb.md
• 用户: ST4R0001 (UID 99565)
• 提交: 2026-07-17 18時26分 (1 月前)
• 管理: 2026-08-30 18時43分 (1 month later)
• 状态: 已接受
• VulDB条目: 397175 [D-Link DSM-G600 1.01 Multipart /load_file.cgi 内存损坏]
• 积分: 20