NSA Ghidra

NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call).

Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input.

NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.

Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection

NSA Ghidra Auto-Analysis Annotation Command Execution

Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search

Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username

Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule

Ghidra < 12.1- Command Injection via URL Annotation Click

Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names

Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import

In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module.

NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory.

NSA Ghidra through 9.0.4 uses a potentially untrusted search path. When executing Ghidra from a given path, the Java process working directory is set to this path. Then, when launching the Python interpreter via the "Ghidra Codebrowser > Window > Python" option, Ghidra will try to execute the cmd.exe program from this working directory.

Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128

Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation

Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount

Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation

Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()

Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive

Ghidra before 12.2 Denial of Service via Extension Archive Install

Ghidra before 12.2 Denial of Service via Compressed Extension Archive

Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser

Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol

Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser

Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server

Ghidra through 12.1.4 Heap Use-After-Free in Decompiler

Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager

Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution

Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation

Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order