CVE-2025-70957

Executive Summary

CVE-2025-70957 is a critical Denial of Service (DoS) vulnerability affecting the TON (The Open Network) Lite Server prior to version v2024.09. The flaw resides in the handling of external arguments passed to locally executed "get methods." An attacker can inject a crafted Continuation object—an internal TVM (TON Virtual Machine) type normally restricted within the VM—that, when executed, consumes excessive CPU resources while incurring disproportionately low virtual gas costs. This "free" computation allows an attacker to monopolize the Lite Server's processing power, significantly reducing throughput and causing a denial of service for legitimate users.

The vulnerability is network-exploitable without authentication, making it particularly dangerous for public-facing TON infrastructure. No public proof-of-concept (PoC) or exploit code has been released at this time, but the technical details are sufficient for a skilled attacker to develop one.

Supply Chain & Package Security

This vulnerability affects the TON Lite Server, which is part of the TON blockchain ecosystem. The software is distributed as a compiled binary and via source code from the official TON repository. Users should verify the integrity of their binaries and ensure they are sourced from the official TON GitHub releases. There is no indication of a compromised package manager or supply chain attack; the vulnerability is a logic flaw in the core software.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and directly impacts service availability. TON Lite Servers are critical infrastructure for the TON network, acting as gateways for users and applications.

Deep Dive & Mechanics

The TON Lite Server processes requests from clients, including "get methods" that execute smart contract code locally. These methods can accept external arguments. The vulnerability lies in how the server handles Continuation objects passed as arguments.

Continuation Objects in TVM: In the TON Virtual Machine (TVM), a Continuation is an internal type representing a saved execution state (like a closure or coroutine). It is normally restricted and not intended to be passed from external callers. However, the Lite Server fails to properly validate or sanitize external arguments, allowing an attacker to inject a crafted Continuation object.

Exploitation Mechanism:

1. The attacker sends a specially crafted request to the Lite Server's "get method" endpoint.
2. The request includes a Continuation object as an argument.
3. The TVM, when executing the method, processes this Continuation.
4. The crafted Continuation contains a loop or recursive structure that performs computationally expensive operations (e.g., repeated hashing, large memory allocations) but with minimal gas cost.
5. Because the gas cost is artificially low, the TVM does not throttle the execution, allowing the Continuation to consume CPU resources indefinitely or for a prolonged period.
6. This monopolizes the Lite Server's processing power, preventing it from handling legitimate requests.

Root Cause: Insufficient validation of external arguments in the "get method" handler. The server should reject any argument that is not a standard TVM type (e.g., integer, cell, slice) and should enforce gas limits on Continuation execution.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-v2024.09): The vulnerable code likely resides in the argument parsing and TVM execution path. A simplified pseudocode representation:

// Vulnerable: No type checking on external arguments
void handle_get_method(Transaction* tx, Method* method, Args* args) {
    for each arg in args {
        // Directly push argument onto TVM stack without validation
        tvm_push(arg);
    }
    tvm_execute(method->code);
}

Patched Code (v2024.09+): The patch introduces type validation and gas cost enforcement:

// Patched: Validate argument types and enforce gas limits
void handle_get_method(Transaction* tx, Method* method, Args* args) {
    for each arg in args {
        // Reject Continuation objects from external callers
        if (arg->type == CONTINUATION) {
            reject_request("Continuation objects not allowed from external callers");
            return;
        }
        // Enforce minimum gas cost for complex operations
        if (arg->type == CELL && cell_depth(arg) > MAX_CELL_DEPTH) {
            reject_request("Argument too complex");
            return;
        }
        tvm_push(arg);
    }
    // Set a hard gas limit for external method execution
    tvm_set_gas_limit(EXTERNAL_METHOD_GAS_LIMIT);
    tvm_execute(method->code);
}

The exact patch can be found in the TON repository commit history for version v2024.09.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A TON Lite Server running a vulnerable version (< v2024.09).
• Network access to the server's port (default 19999 for ADNL, or 8080 for HTTP API).
• Understanding of TVM serialization and Continuation object structure.

Exploitation Steps:

1. Craft the Malicious Continuation: Create a Continuation object that contains an infinite loop or a computationally expensive operation. The Continuation must be serialized in the TL-B (Type-Length-Binary) format used by TON.
2. Construct the Request: Build a valid "get method" request that includes the crafted Continuation as an argument. The request format depends on the API (ADNL or HTTP).
3. Send the Request: Transmit the request to the vulnerable Lite Server.
4. Observe DoS: The server's CPU usage will spike to 100%, and legitimate requests will time out or be rejected.

Example Request (Conceptual):

import socket

# Craft a malicious Continuation (simplified)
continuation = b'\x01\x02\x03...'  # Serialized Continuation with infinite loop

# Build ADNL request
request = build_adnl_request(
    method="get_method",
    args=[continuation]
)

# Send to server
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("target_ip", 19999))
sock.send(request)
sock.close()

Note: No public exploit code is available. The above is a conceptual outline.

Blue Team (Defensive)

Detection:

• Monitor CPU usage on Lite Server hosts. Sustained 100% CPU usage without corresponding legitimate traffic is a strong indicator.
• Analyze network traffic for unusually large or malformed "get method" requests.
• Implement rate limiting on "get method" calls per IP address.

Mitigation:

• Immediately upgrade to TON Lite Server v2024.09 or later.
• If patching is not possible, restrict network access to the Lite Server using firewall rules (allow only trusted IPs).
• Deploy a Web Application Firewall (WAF) or reverse proxy that can inspect and block malformed requests.
• Enable logging and alerting for "get method" execution times exceeding a threshold.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_70957_TON_Lite_Server_DoS {
    meta:
        description = "Detects malicious Continuation objects in TON Lite Server traffic"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-70957"
    strings:
        $continuation_magic = { FF FF FF FF }  // Example magic bytes for Continuation
        $loop_pattern = { 00 01 02 03 }        // Example loop opcodes
    condition:
        $continuation_magic at 0 and #loop_pattern > 5
}

Sigma Rule

title: CVE-2025-70957 - TON Lite Server DoS Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-70957 via anomalous "get method" requests
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: ton_lite_server
detection:
    selection:
        method: "get_method"
        arg_size: > 1024
    condition: selection
falsepositives:
    - Legitimate large smart contract arguments
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 19999 (msg:"CVE-2025-70957 TON Lite Server DoS Attempt"; flow:to_server,established; content:"|FF FF FF FF|"; depth:4; content:"get_method"; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade all TON Lite Server instances to version v2024.09 or later. The patch is available from the official TON repository.
2. Restrict Access: If patching is delayed, restrict network access to the Lite Server using firewall rules. Only allow connections from trusted IPs (e.g., other TON nodes, known clients).
3. Rate Limiting: Implement rate limiting on "get method" calls per IP address to mitigate DoS attempts.

Long-Term Measures:

1. Input Validation: Ensure all external arguments to "get methods" are strictly validated. Reject any non-standard TVM types (e.g., Continuation).
2. Gas Limits: Enforce hard gas limits on all externally triggered method executions.
3. Monitoring: Deploy monitoring for CPU usage, request sizes, and execution times. Set up alerts for anomalies.
4. Regular Updates: Subscribe to TON security advisories and apply patches promptly.

Workarounds (if patching is not possible):

• Disable "get methods" for untrusted users (if business requirements allow).
• Use a reverse proxy to inspect and filter requests before they reach the Lite Server.

Valters IT