Security researchers from Fenrisk disclosed vulnerabilities in the Pagure and OBS (Open Build Service) tools that allowed the compromise of the package build infrastructures for Fedora and openSUSE. Researchers demonstrated the possibility of executing arbitrary code on servers running Pagure and OBS, which could be used to inject changes into the packages in the Fedora and openSUSE repositories.
Four vulnerabilities were found in the Pagure platform, used in Fedora for collaboration on code and metadata of packages. Exploitation of these issues requires an account on the Pagure service, which anyone can obtain (currently, there are 24,899 users registered at Pagure.io). Three of the issues allow for file reading on the system, while one allows executing code on the system. serverThe issues were identified on January 1, 2024, reported through bugzilla.redhat.com on April 25, 2024, and fixed in Pagure within three hours.
- Vulnerabilities CVE-2024-4981 and CVE-2024-47515 are due to improper handling of symbolic links in file update and archive generation functions. These vulnerabilities enable reading the contents of local files on the server, for instance, revealing the content of the administrator session configuration file for Pagure, thereby gaining access with its permissions. Exploiting the vulnerability in the _update_file_in_git() function involves creating a repository in Pagure; adding a commit with a new file, which is created as a symbolic link to the desired system file; and opening this file for editing in the web interface.
- The vulnerability (CVE-2024-4982) in the view_issue_raw_file() function allows traversing beyond the base directory by specifying the characters "\/.." in the parameters of the requested Issue. This issue permits reading files in the system, as long as the permission of the process running the web interface allows it. For instance, to view the file \/etc\/passwd, one can access the page "http:\/\/pagure.local:5000\/your-repository\/issue\/raw\/..\/..\/..\/..\/..\/..\/..\/etc\/passwd".
- The vulnerability (CVE-2024-47516) in the PagureRepo.log() function allows for command injection and code execution on the server. This issue arises because when viewing file change history through the web interface, the 'git' command is invoked with the branch identifier passed in the command line (for example, '/usr/bin/git --pretty=oneline --abbrev-commit -- README.md'). The validity of the identifier is not checked, allowing any command line option to be passed instead, such as '--output=/tmp/foo.bar' to redirect output to a file. An attacker can overwrite a file in the system by sending a request like: http://pagure.local:5000/test/history/README.md?identifier=--output=/tmp/foo.bar
Pagure runs under the git user, so files of this user can only be overwritten. To execute their own code on the server, an attacker can use a service for access to the repository via SSH, which triggers the command 'bash -c /usr/libexec/pagure/aclchecker.py'. The attacker can exploit the vulnerability to overwrite the file '/srv/git/.bashrc', which will be executed by the bash shell when accessing the repository via SSH.
The attack involves registering in the Pagure system, creating a repository, adding a README.md file with a commit message like '|| /bin/bash', and sending a request to 'http://pagure.local:5000/test/history/README.md?identifier=--output=/srv/git/.bashrc'. As a result of these steps, the string '34a5c43 || /bin/bash' will be written to the file '/srv/git/.bashrc'. To execute the created file '/srv/git/.bashrc', one just needs to connect to the repository via SSH under their account. Executing code with the git user privileges on the Pagure server allows control over all repository contents with the packages.
A vulnerability (CVE-2024-22033) has been discovered in the OBS (Open Build Service) platform, used in openSUSE and some other distributions for package building, allowing code execution on the server. The vulnerability was identified on June 27, 2024, reported to the openSUSE project on June 29, and fixed on July 10.
The vulnerability exists in the "obs-service-download_url" service, which lacked proper URL verification when launching wget from a script that downloads source code into OBS. An attacker can specify in the OBS service the configuration of the package being created, where instead of a URL for downloading the code, a command-line option for wget can be indicated, for example: --output-document=/tmp/test tempfile
To bypass the error returned when attempting to run wget without a URL, the example provides the "download-manifest" option, which allows specifying a list of URLs in a separate file. The above example will lead to the execution of the command: /usr/bin/wget -i /srv/obs/service/XXXXX/src/tempfile -4 --output-document=/tmp/test
which allows writing to the file /tmp/test the content downloaded from the link specified in the file /srv/obs/service/XXXXX/src/tempfile from the code uploaded by the attacker in OBS through the build.opensuse.org interface, which allows free registration. In addition to overwriting the file on the server, the attacker can also send any file to themselves by specifying the "--post-file" option instead of "--output-document", for example, "--post-file=/etc/passwd". Thus, the attacker can read and write files on the server, subject to the access rights under which the OBS service operates.
To turn the ability to write to a file into code execution on the server, researchers proposed a method consisting of two stages. The two stages are necessary because the attacker can create a file named ".wgetrc" with settings for wget, but that is not enough to run commands. However, through ".wgetrc", conditions can be created to execute any program in the system, but without passing arguments to it. To execute arbitrary code, it has been proposed to launch the "prove" program, which processes the configuration file ".proverc", allowing the "--exec" option to execute any code.
In the first stage, through the aforementioned manipulations with 'download-manifest' in the home directory of the user 'obsservicerun', a file '.proverc' is created, which includes commands that will be executed upon starting the 'prove' process. In the second stage, a file '.wgetrc' is created with the parameter 'use-askpass=/usr/bin/prove', leading to the invocation of 'prove'. After these files are created, it is sufficient to create conditions for downloading any data using wget, which will trigger the attacker's code on the server with the rights of the user 'obsservicerun'. The rights of the user 'obsservicerun' are sufficient to extract keys from the repositories used by OBS users for signing packages.
Addendum: The SUSE Product Security team believes that the danger posed by the vulnerability in OBS is overestimated, and the researchers' statement that the issue allows for the compromise of all packages in the openSUSE distribution is not accurate. It is noted that the services in the build.opensuse.org infrastructure run using isolated containers that are recreated and contain no critical information. The identified vulnerability is assessed as dangerous but not sufficient to compromise the openSUSE build infrastructure and the generated packages. Moreover, it is stated that actions in the OBS interface, as described in the attack example, could only have been carried out in a locally installed version of OBS on the developer's workstation.
Source: opennet.ru
