CVE-2022-32504

Executive Summary

CVE-2022-32504 is a critical stack buffer overflow vulnerability discovered in Nuki Home Solutions devices, specifically the Nuki Smart Lock (versions 3.0 and 2.0) and Nuki Bridge (versions v1 and v2). The flaw resides in the JSON parsing logic used for WebSocket communications, allowing an attacker to trigger a stack buffer overflow by sending a specially crafted JSON payload. Successful exploitation could lead to arbitrary code execution on the affected device, potentially compromising physical access control systems. The vulnerability has a CVSS score of 0.0 (likely unassigned or pending), but based on the impact, it is considered critical. No public proof-of-concept (PoC) or exploit code is available at this time, and the vendor has released firmware updates to address the issue.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)
• Threat Level: Critical (based on impact and exploitability)

Deep Dive & Mechanics

The vulnerability is a classic stack buffer overflow (CWE-121) in the JSON parsing routine of the WebSocket service. The device listens for JSON objects over WebSocket connections, and the parsing code does not properly validate the length of input strings before copying them into fixed-size stack buffers. An attacker can craft a JSON payload containing an overly long string value that, when parsed, overflows the stack buffer, overwriting adjacent memory regions including the return address and other critical data.

The attack flow:

1. The attacker establishes a WebSocket connection to the target device (typically on port 443 or a custom port).
2. The attacker sends a malicious JSON object with a string field that exceeds the expected buffer size.
3. The device's JSON parser copies the string into a stack buffer without bounds checking.
4. The overflow corrupts the stack, allowing the attacker to control the program counter (PC) and execute arbitrary shellcode.
5. The attacker can then gain full control of the device, potentially unlocking doors, disabling alarms, or pivoting to other network devices.

Vulnerable vs. Patched Code

The vulnerable code likely uses a function like strcpy or sprintf to copy JSON string values into a stack buffer. The patched code would use safer alternatives such as strncpy, snprintf, or a JSON library with built-in bounds checking.

Vulnerable Code (C-like pseudocode):

void parse_json(char *json) {
    char buffer[256];
    // Extract string value from JSON
    char *value = extract_string(json);
    // Vulnerable: no bounds check
    strcpy(buffer, value);
    // Process buffer...
}

Patched Code (C-like pseudocode):

void parse_json(char *json) {
    char buffer[256];
    // Extract string value from JSON
    char *value = extract_string(json);
    // Safe: limit copy size
    strncpy(buffer, value, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // Process buffer...
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: Nuki Smart Lock 3.0 (firmware < 3.3.5) or Nuki Bridge v2 (firmware < 2.13.2)
• Attacker: Kali Linux with Python3 and websocket-client library
• Network: Same local network (or WAN if device is exposed)

Exploitation Steps:

1. Identify the device's IP address (e.g., via Shodan or local network scan).
2. Connect to the WebSocket service (e.g., ws://<device_ip>:8080/ws).
3. Craft a malicious JSON payload with an oversized string field.
4. Send the payload and trigger the overflow.
5. Execute shellcode to gain a reverse shell or perform arbitrary actions.

Example Python script (conceptual):

import websocket
import json

def exploit(target_ip, port=8080):
    ws = websocket.create_connection(f"ws://{target_ip}:{port}/ws")
    # Craft malicious JSON with overflow
    payload = {
        "command": "A" * 500  # Overflow buffer
    }
    ws.send(json.dumps(payload))
    response = ws.recv()
    print(response)
    ws.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Blue Team

Detection & Response:

• Monitor for unusually large WebSocket payloads (e.g., > 1024 bytes).
• Implement network segmentation to isolate IoT devices from critical systems.
• Use intrusion detection systems (IDS) to alert on anomalous JSON structures.
• Regularly update firmware to patched versions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • WebSocket connections to Nuki devices with payloads exceeding 1024 bytes.
  • Outbound connections from Nuki devices to unknown IP addresses (potential reverse shell).
• Host IOCs:
  • Unexpected process crashes or reboots on Nuki devices.
  • Modified firmware or configuration files.
• File IOCs:
  • Presence of shellcode or malicious binaries in device memory (requires forensic analysis).

Detection Engineering

YARA Rule

rule CVE_2022_32504_Nuki_JSON_Overflow {
    meta:
        description = "Detects malicious JSON payloads targeting Nuki devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-32504"
    strings:
        $json_start = "{\"command\":\""
        $overflow = /[A-Za-z0-9]{500,}/  // Overly long string
    condition:
        $json_start and #overflow > 0
}

Sigma Rule

title: CVE-2022-32504 Nuki WebSocket Buffer Overflow Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2022-32504 via oversized WebSocket payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 2100001  # Custom ID
    condition: selection
fields:
    - src_ip
    - dest_ip
    - payload_length
falsepositives:
    - Legitimate large firmware updates (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 8080 (msg:"CVE-2022-32504 Nuki WebSocket Buffer Overflow Attempt"; flow:to_server,established; content:"|7b 22 63 6f 6d 6d 61 6e 64 22 3a 22|"; distance:0; within:12; content:"|22 7d|"; distance:0; within:2; byte_test:1,>,100,0; classtype:attempted-admin; sid:2100001; rev:1;)

Remediation & Mitigation

• Immediate: Update all Nuki Smart Lock devices to firmware 3.3.5 (3.0) or 2.12.4 (2.0). Update Nuki Bridge devices to firmware 1.22.0 (v1) or 2.13.2 (v2).
• Network: Restrict WebSocket access to trusted IPs only. Use a firewall to block unauthorized connections.
• Monitoring: Enable logging and alerting for anomalous WebSocket traffic.
• Long-term: Implement input validation and bounds checking in all JSON parsing routines. Consider using a memory-safe language or library for critical components.

Report generated by Valters IT DevSecOps & CTI Expert System