Junglewise Threat Intelligence

@napi-rs/image heap buffer overflow via libwebp

Severity: low · CVSS 3.1 · Published 2023-09-27

Vendors: npm.

Executive brief

@napi-rs/image is a Node.js image processing library that bundles the libwebp WebP image decoder. A heap buffer overflow vulnerability in libwebp's lossless WebP decoding (VP8L) allows an attacker to craft a malicious WebP image file that, when processed by the library, writes data beyond allocated memory boundaries. This can lead to application crashes, memory corruption, and potentially arbitrary code execution if exploited by a sophisticated attacker.

Technical details

The vulnerability is a heap buffer overflow (CVE-2023-4863) in libwebp's VP8L (lossless WebP) decoder, specifically in the BuildHuffmanTable function used during Huffman code decompression. The vulnerable code pre-allocates a fixed-size buffer for Huffman tables based on estimated sizes, then directly writes the constructed tables into that allocation without verifying that the actual table size does not exceed the pre-allocated buffer. An attacker can craft a malicious WebP image with specially crafted Huffman code lengths that cause the table construction to exceed the buffer boundary, writing into adjacent heap memory. The vulnerability requires network-level attack vector (remote attacker delivers a crafted WebP) and user interaction (processing/viewing the image), but no authentication or elevated privileges. Exploitation can result in memory corruption, denial of service, or potentially arbitrary code execution. The fix, available in @napi-rs/image version 1.7.0 and later, implements a two-pass Huffman table construction that first calculates the required size before writing, and allocates a larger buffer if needed.

Affected products

  • npm @napi-rs/image < 1.7.0

Timeline

  • 2023-09-06: disclosed: Apple security team reported WebP vulnerability to Chrome
  • 2023-09-07: patched: Google released patch for CVE-2023-4863 in libwebp; @napi-rs/image updated in version 1.7.0
  • 2023-09-06: exploited: Google marked CVE-2023-4863 as exploited in the wild; vulnerability used in BLASTPASS iPhone attack to bypass iMessage sandbox
  • 2023-09-27: advisory: GHSA-4vjr-crvh-383h published

References