Full Report
Huntress is tracking a new critical vulnerability seen in the wild that affects anything using the libwebp WebP image library. Here’s what we know so far.
Analysis Summary
# Vulnerability: WebP libwebp Heap Buffer Overflow
## CVE Details
- **CVE ID:** CVE-2023-4863
- **CVSS Score:** 8.8 (Critical)
- **CWE:** CWE-787 (Out-of-bounds Write)
## Affected Systems
- **Products:** Software utilizing the `libwebp` library for image encoding/decoding. This includes most major web browsers, Electron-based applications (e.g., Discord, Slack, VS Code), and various image processing tools.
- **Versions:** `libwebp` versions prior to 1.3.2.
- **Configurations:** Systems that process or render WebP lossless images.
## Vulnerability Description
The flaw exists in the `BuildHuffmanTable` function of the `libwebp` library. When the library processes a specially crafted WebP lossless image file, it triggers a heap buffer overflow (out-of-bounds write). Specifically, the vulnerability occurs during the decoding of Huffman tables, allowing an attacker to write data beyond the allocated buffer in the heap memory.
## Exploitation
- **Status:** Exploited in the wild.
- **Complexity:** Medium (Successful exploitation for RCE requires bypassing modern memory protections, though DoS is Low).
- **Attack Vector:** Network (Remote). The victim only needs to view a malicious WebP image via a browser or affected application.
## Impact
- **Confidentiality:** High (Potential for Remote Code Execution (RCE) and data theft).
- **Integrity:** High (Potential for unauthorized system changes via RCE).
- **Availability:** High (Can lead to application crashes and Denial of Service (DoS)).
## Remediation
### Patches
- **libwebp:** Update to version **1.3.2** or higher.
- **Web Browsers:**
- Google Chrome: Update to 116.0.5845.187 (Mac/Linux) or 116.0.5845.187/.188 (Windows).
- Mozilla Firefox: Update to 117.0.1.
- Microsoft Edge: Update to 116.0.1938.81.
- **Electron Applications:** Users must wait for individual vendors to release updates that incorporate the patched version of the library.
### Workarounds
- **Software Inventory:** Maintain an accurate inventory of software versions to identify vulnerable Electron-based applications.
- **Restricted Rendering:** Where possible, restrict the rendering of untrusted WebP images until patches are applied.
## Detection
- **Indicators of Compromise:** Application crashes when opening specific WebP files; unusual memory usage patterns in browser processes.
- **Detection Methods:** Vulnerability scanners (authenticated) can identify outdated versions of `libwebp.so` or `libwebp.dll` on the file system.
## References
- Google Chrome Security Advisory: [https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html]
- Technical Writeup by Ben Hawkes: [https://blog.isosceles.com/the-webp-0day/]
- CVE Record: [https://www.cve.org/CVERecord?id=CVE-2023-4863]
- Huntress Blog: [https://www.huntress.com/blog/critical-vulnerability-webp-heap-buffer-overflow-cve-2023-4863]