bug: Specially Crafted EXE Files May Bypass Virus Scanner

[Sewer56]

What happened?

Note: This is filed as a 'bug' rather than a security vulnerability because it's not in scope of the criteria set in SECURITY.md, as it requires client interaction to be dangerous.

---

Context

Currently the file server uses the mime type obtained from the tree_magic library to determine file type.

https://github.com/revoltchat/autumn/blob/d4f4f72678ec083169d23e5daf979bf188bf41fe/src/routes/upload.rs#L62-L68

And the audio mime types are blindly accepted.

https://github.com/revoltchat/autumn/blob/d4f4f72678ec083169d23e5daf979bf188bf41fe/src/routes/upload.rs#L215-L220

The tree_magic library used here uses the signatures from usr/share/mime/magic.

Problem

It's possible to manually craft an EXE that gets detected as a WAV file, and therefore be treated as an Audio file during upload.

Code:

// Load a file
let input: &[u8] = include_bytes!("hello.exe");

// Find the MIME type of the file
let result = tree_magic::from_u8(input);

// returns WAVE instead of EXE

Sample file: hello-world.zip

Just replace the file path in the code.

Cause

It's possible to alter the EXE header such that it's instead detected as a WAV file.

The modification is done at offset 0x8 of the file, by adding a WAVE text in ASCII, so the file is detected as audio/vnd.wave (audio/wav) rather than application/x-ms-ne-executable.

0:0000  4D 5A 90 00 03 00 00 00 57 41 56 45 FF FF 00 00  MZ........WAVE........

Due to the priorities either in tree_magic or the source magic file, the WAVE magic can take priority over the EXE Header. Thus the application sees it as a music track, and does not scan the file.

The modified EXE will still run, because we modified the DOS header, which is mostly ignored by Windows.
(I tested in Wine, and then on Win10)

[insertish]

Autumn re-write uses infer crate which correctly identifies this file as an executable.

https://github.com/revoltchat/backend/blob/main/crates/services/autumn/src/mime_type.rs#L8

[Sewer56]

👏