What this actually is.
Technical background, root cause, and affected surface.
Pre-auth. hdrbuf[1000] (webio.h:181) overflowed via sprintf(cp,"File: %s",sess->ws_uri) in wi_senderr (webutils.c:93,109). WI_RXBUFSIZE=153600. URI[754] lands at hdrbuf[1000]=wi_execfunc (BSS function pointer). Confirmed live: response[1000:1004]=0x41424344. 1769 bytes returned vs 1000-byte buffer. 18+ year old bug (Webio © 2007)
- Vendor
- UltraVNC
- Product
- UltraVNC Repeater
- Severity
- Critical
- CVSS Score
- 9.8
- Status
- Fixed
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-787: Out-of-bounds Write
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
poc_finding005_repeater_overflow_vendor.py: GET /[1500xA] HTTP/1.0 → 404 → wi_senderr writes URI into hdrbuf[1000]. Crash-trigger only; no shellcode.
The bug, and the fix.
char hdrbuf[HDRBUFSIZE]; // global 1000 bytes (webio.h:181) char *cp = hdrbuf + strlen(hdrbuf); sprintf(cp, "WWW-Authenticate: Basic realm=\"%s\"", sess->ws_uri); // attacker URI cp += strlen(cp); sprintf(cp, "File: %s<br>", sess->ws_uri); // second overflow
Root cause: sprintf used instead of snprintf for attacker-controlled URI into a fixed 1000-byte global buffer shared across threads. No URI length validation before response construction.
When does this fire?
All conditions must be true for the exploit to succeed.
Attacker reaches repeater HTTP port (default TCP 80). 2. Sends HTTP request with URI ≥1001 bytes (any method). 3. Server generates 4xx/2xx response. 4. wi_senderr/wi_replyhdr writes full URI into hdrbuf[1000] without length check.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
RCE as the repeater process user. All relayed VNC sessions exposed. Complete host compromise of the relay node.
C:H · I:H · A:H
CWE-787: Out-of-bounds Write
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Replace sprintf with snprintf using remaining buffer space as limit. Allocate response buffer per-session. Vendor fix: sprintf → snprintf with HDR_REMAINING bounds; wi_sanitize_uri() added before embedding URI.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered during security audit
Reported to UltraVNC team
Vendor fix validated
Planned public disclosure
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.