Attacker Value
Moderate
(1 user assessed)
Exploitability
High
(1 user assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
0

CVE-2018-18629

Disclosure Date: December 20, 2018
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. An untrusted search path vulnerability in the keybase-redirector application allows a local, unprivileged user on Linux to gain root privileges via a Trojan horse binary.

Add Assessment

1
Ratings
  • Attacker Value
    Medium
  • Exploitability
    High
Technical Analysis

Description

The installation of a vulnerable version of Keybase deploys a SUID binary named “keybase-redirector” which calls the “fusermount” binary using a relative path, making the application trust the value of $PATH. This triggers a PATH injection vulnerability which allows local privilege escalation by using a malicious file with its name set to “fusermount”.

Mitigation

The maintainer has released some fixes, so the software must be upgrade to Keybase version 2.8.0-20181023124437 or above.

Affected Systems

All Keybase versions prior to 2.8.0-20181023124437.

PoC

1- We can identify a potential vulnerable installation with the following command, which will help us identify the SUID binary related to Keybase.

find / -perm 4000 2>/dev/null | grep keybase

2- To verify the vulnerability, we check the output of the following command is prior to 2.8.0-20181023124437.

keybase -v

3- In case the the software version is vulnerable, we may create a malicious binary (which executes, for example, a rshell, creates a high privilege user, etc.) with the name fusermount and deploy it on a directory to be injected on the PATH.

NOTE: Development and compilation of the binary left for the tester

4- We add the directory in the first position inside the path variable and execute the Keybase software.

env PATH=<malicious_dir_path>:$PATH /usr/bin/keybase-redirector /keybase

This will execute the payload inside the malicious binary as root.

Personal Notes
In some engagements, I have seen this software installed on workstation or servers from DevOps/SecDevOps teams, where they manage access keys and credentials for critical corporate infrastructure. Because of this, a Keybase vulnerable installation should not be taken lightly.

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • keybase

Products

  • keybase

Additional Info

Technical Analysis