CVE-2023-41101

Vulnerability

The vulnerability is a buffer overflow in OpenNDS's captive portal, specifically in the get_query function in http_microhttpd.c, where the length of the query string in GET requests is not validated. This leads to a stack-based buffer overflow in versions 9.x and earlier, and a heap-based buffer overflow in versions 10.x and later. Affected versions are before OpenNDS version 10.1.3 [1][2].

Exploitation

An attacker needs to send a specially crafted GET request with an overly long query string to the captive portal. No authentication is required as the captive portal is typically accessible before authentication. The overflow can be triggered without user interaction [1].

Impact

Successful exploitation allows an attacker to cause a denial-of-service condition by crashing OpenNDS, or potentially achieve remote code execution by injecting and executing arbitrary bytecode (RCE) [1][2].

Mitigation

The vulnerability is fixed in OpenNDS version 10.1.3 and later [2]. OpenWrt master and 23.05 were updated to OpenNDS 10.2.0 on 23 November 2023 [3]. Users should upgrade to the latest version. No workaround is provided.