CVE-2023-51456

Executive Summary

CVE-2023-51456 is a critical Improper Input Validation vulnerability affecting the v2_sdk_service running on port 10000 across multiple DJI drone models. The flaw resides in the v2_pack_array_to_msg function within the libv2_sdk.so library, where a missing input sanity check allows an attacker to trigger an out-of-bounds read/write condition. This can lead to memory information disclosure or arbitrary code execution. The vulnerability is exploitable over the network (adjacent) without authentication, posing a significant risk to drone operations and data integrity. No public proof-of-concept (PoC) or exploit code is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in DJI's proprietary SDK library.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
• Attack Vector (AV): Adjacent Network – attacker must be on the same network segment as the drone.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None.
• User Interaction (UI): None.
• Scope (S): Unchanged.
• Confidentiality (C): Low – potential memory leak.
• Integrity (I): Low – potential memory corruption.
• Availability (A): High – out-of-bounds write can crash the service or drone.

Threat Level: High for operational environments where drones are used in sensitive missions (e.g., surveillance, mapping). The lack of a patch and the potential for arbitrary code execution make this a priority for mitigation.

Deep Dive & Mechanics

The vulnerability is in the v2_sdk_service binary, which listens on TCP port 10000. This service handles communication between the drone and a ground control station (GCS) using a proprietary protocol. The v2_pack_array_to_msg function in libv2_sdk.so is responsible for serializing array data into a message buffer.

Root Cause: The function does not validate the size of the input array against the allocated buffer. An attacker can send a crafted payload with an oversized array length, causing the function to write beyond the buffer boundaries. This out-of-bounds write can corrupt adjacent memory, potentially leading to:

• Memory Information Leak: Reading out-of-bounds data can expose sensitive information (e.g., encryption keys, flight logs).
• Arbitrary Code Execution: Overwriting function pointers or return addresses can redirect execution to attacker-controlled shellcode.

Attack Flow:

1. Attacker connects to port 10000 on the drone.
2. Sends a malicious packet with a manipulated array length field.
3. The v2_pack_array_to_msg function processes the packet without proper bounds checking.
4. Out-of-bounds write occurs, corrupting memory.
5. Depending on the payload, the attacker can leak data or execute code.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code path. The vulnerable function v2_pack_array_to_msg likely looks like this (pseudocode):

// Vulnerable version
int v2_pack_array_to_msg(uint8_t *buffer, size_t buf_size, uint32_t *array, size_t array_len) {
    // Missing check: if (array_len * sizeof(uint32_t) > buf_size) return -1;
    memcpy(buffer, array, array_len * sizeof(uint32_t));
    return 0;
}

A patched version would include a bounds check:

// Patched version
int v2_pack_array_to_msg(uint8_t *buffer, size_t buf_size, uint32_t *array, size_t array_len) {
    if (array_len * sizeof(uint32_t) > buf_size) {
        return -1; // Error: buffer overflow
    }
    memcpy(buffer, array, array_len * sizeof(uint32_t));
    return 0;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• DJI drone with vulnerable firmware (e.g., Mavic 3 Pro < v01.01.0300).
• Network access to the drone's port 10000 (adjacent network).
• Knowledge of the proprietary protocol (reverse-engineered).

Exploit Steps:

1. Reconnaissance: Scan for drones on port 10000 using Shodan or Nmap.

   nmap -p 10000 --open <target_subnet>
   

2. Craft Payload: Create a packet with an oversized array length field.

   import socket
   import struct
   
   # Example payload (simplified)
   payload = b'\x00' * 100  # Header
   array_len = 0xFFFFFFFF   # Overflow value
   payload += struct.pack('<I', array_len)
   payload += b'A' * 1000   # Data to trigger overflow
   
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect(('192.168.1.100', 10000))
   sock.send(payload)
   sock.close()
   

3. Trigger Overflow: Send the payload to the drone. The out-of-bounds write may crash the service or allow code execution.
4. Post-Exploitation: If code execution is achieved, deploy a reverse shell or exfiltrate data.

Note: No public exploit code is available; this is a conceptual example.

Blue Team (Defense)

Detection:

• Monitor network traffic to/from port 10000 for anomalous packet sizes or patterns.
• Use IDS/IPS rules to detect oversized array fields.

Mitigation:

• Isolate drone networks from untrusted devices.
• Apply network segmentation and firewall rules to restrict access to port 10000.
• Monitor for crashes or unexpected behavior in the v2_sdk_service.

Indicators of Compromise (IOCs)

• Network:
  • TCP connections to port 10000 from unexpected IP addresses.
  • Packets with abnormally large payload sizes (> 1024 bytes) on port 10000.
  • Repeated connection attempts to port 10000.
• Host:
  • Crash logs for v2_sdk_service or libv2_sdk.so.
  • Memory dumps showing out-of-bounds data.
  • Unusual processes or shell sessions on the drone.
• Firmware:
  • Modified or corrupted firmware files.
  • Unexpected changes to flight logs or configuration.

Detection Engineering

YARA Rule

rule CVE_2023_51456_DJI_v2_sdk_service {
    meta:
        description = "Detects out-of-bounds write attempts in v2_sdk_service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-51456"
    strings:
        $s1 = "v2_pack_array_to_msg" ascii wide nocase
        $s2 = "libv2_sdk.so" ascii wide nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: CVE-2023-51456 DJI v2_sdk_service Out-of-Bounds Write
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic targeting DJI drone port 10000 with oversized payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 10000
        ip_protocol: tcp
        payload_length: '> 1024'
    condition: selection
falsepositives:
    - Legitimate large firmware updates (rare)
level: high

Suricata Rule

alert tcp any any -> any 10000 (msg:"CVE-2023-51456 DJI v2_sdk_service Out-of-Bounds Write Attempt"; flow:to_server; content:"|00 00 00 FF|"; depth:4; offset:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate drone networks from untrusted devices. Use VLANs or firewalls to restrict access to port 10000.
2. Access Control: Implement IP whitelisting for devices that can connect to the drone.
3. Monitoring: Enable logging and monitoring for port 10000 traffic. Alert on anomalous packet sizes.
4. Firmware Updates: Check DJI's official website for firmware updates. If available, apply immediately.

Long-Term Fix:

• DJI must release a patched firmware that includes input validation in v2_pack_array_to_msg.
• Until then, consider using a VPN or encrypted tunnel for drone communication.

Workaround:

• Disable the v2_sdk_service if not required (may affect functionality).
• Use a network-based IDS/IPS to block exploit attempts.

Valters IT
Securing Digital Frontiers