CVE-2023-38313

Vulnerability

CVE-2023-38313 is a NULL pointer dereference vulnerability in the do_binauth function of OpenNDS Captive Portal versions prior to 10.1.2. It can be triggered by sending a crafted GET HTTP request that omits the client_redirect query string parameter. The vulnerable code path is only reachable when the BinAuth option is enabled in the configuration [1].

Exploitation

An unauthenticated attacker with network access to the OpenNDS Captive Portal can exploit this vulnerability by sending a specially crafted GET request to the authentication service. The request must omit the client_redirect query string parameter while the BinAuth option is active. No user interaction or special privileges are required beyond network-level connectivity [1][2].

Impact

Successful exploitation results in a NULL pointer dereference, causing the OpenNDS daemon to crash. This leads to a denial-of-service condition, disrupting captive portal authentication for all clients. The crash does not provide any information disclosure, privilege escalation, or code execution [1][2].

Mitigation

The vulnerability is fixed in OpenNDS version 10.1.2 and later [1]. OpenWrt distributions updated OpenNDS to version 10.1.3 on August 28, 2023 [2]. Users should upgrade to version 10.1.2 or higher. If the BinAuth option is not required, disabling it mitigates the risk. No known workarounds exist for systems that require BinAuth functionality [1][2].