CVE-2021-43579
📋 TL;DR
CVE-2021-43579 is a stack-based buffer overflow vulnerability in HTMLDOC's BMP image processing function that allows remote code execution when processing malicious BMP files. This affects users who convert HTML documents containing external BMP images using HTMLDOC version 1.9.13 and earlier. Attackers can exploit this by tricking victims into converting documents with crafted BMP files.
💻 Affected Systems
- HTMLDOC
📦 What is this software?
Htmldoc by Htmldoc Project
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with the privileges of the HTMLDOC process, potentially leading to complete system compromise, data theft, or lateral movement.
Likely Case
Remote code execution leading to malware installation, data exfiltration, or system disruption on vulnerable systems.
If Mitigated
Denial of service or application crash if exploit fails or protections like ASLR/DEP are effective.
🎯 Exploit Status
Proof-of-concept exists in GitHub issues. Exploitation requires the victim to process a malicious document, but no authentication is needed for the vulnerability itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.14 and later
Vendor Advisory: https://github.com/michaelrsweet/htmldoc/commit/27d08989a5a567155d506ac870ae7d8cc88fa58b
Restart Required: No
Instructions:
1. Download HTMLDOC 1.9.14 or later from official repository. 2. Compile and install according to platform instructions. 3. Replace existing HTMLDOC binary with patched version.
🔧 Temporary Workarounds
Disable BMP processing
allModify HTMLDOC configuration or source to disable BMP image loading functionality
# Requires source code modification in image.c or compile-time flags
Input validation
linuxImplement pre-processing to validate/sanitize BMP files before HTMLDOC processing
# Use tools like file or imagemagick to validate BMP files before processing
🧯 If You Can't Patch
- Restrict HTMLDOC usage to trusted users and documents only
- Implement network segmentation to isolate HTMLDOC systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check HTMLDOC version: htmldoc --version 2>&1 | grep -i versionCheck Version:
htmldoc --version 2>&1 | grep -i version || dpkg -l | grep htmldoc || rpm -qa | grep htmldocVerify Fix Applied:
Verify version is 1.9.14 or later and test with known safe BMP files📡 Detection & Monitoring
Log Indicators:
- HTMLDOC process crashes with segmentation faults
- Unexpected child processes spawned from HTMLDOC
Network Indicators:
- Downloads of BMP files followed by HTMLDOC execution
- Outbound connections from HTMLDOC process
SIEM Query:
process_name:"htmldoc" AND (event_type:"process_crash" OR child_process_count > 0)🔗 References
- https://github.com/michaelrsweet/htmldoc/commit/27d08989a5a567155d506ac870ae7d8cc88fa58b
- https://github.com/michaelrsweet/htmldoc/compare/v1.9.12...v1.9.13
- https://github.com/michaelrsweet/htmldoc/issues/453
- https://github.com/michaelrsweet/htmldoc/issues/456
- https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html
- https://github.com/michaelrsweet/htmldoc/commit/27d08989a5a567155d506ac870ae7d8cc88fa58b
- https://github.com/michaelrsweet/htmldoc/compare/v1.9.12...v1.9.13
- https://github.com/michaelrsweet/htmldoc/issues/453
- https://github.com/michaelrsweet/htmldoc/issues/456
- https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html
