CVE-2023-38322

Vulnerability

An issue exists in OpenNDS Captive Portal versions before 10.1.2, where a NULL pointer dereference occurs in the do_binauth function when a crafted GET HTTP request lacking a User-Agent header is processed. The vulnerability is only reachable when the BinAuth option is enabled. The affected OpenNDS versions are those prior to the 10.1.2 release, with the fix included in version 10.1.3 [1], [2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted GET request from an unauthenticated client to the captive portal, with the User-Agent HTTP header omitted. The attack requires no prior authentication or network position beyond normal network access to the captive portal. The crash occurs during the authentication process when the BinAuth option is set [1].

Impact

Successful exploitation results in a denial-of-service (DoS) condition by crashing the OpenNDS process. This disrupts captive portal services for all clients until the service is manually restarted. The vulnerability does not lead to information disclosure, code execution, or privilege escalation [1].

Mitigation

OpenNDS has fixed this vulnerability in version 10.1.3, released on or before 28 August 2023. The patch is incorporated into OpenWrt master, OpenWrt 23.05, and OpenWrt 22.03. Users should update OpenNDS to version 10.1.3 or later. If immediate update is not possible, disabling the BinAuth option can prevent the vulnerable code path from being triggered [1], [2].