{"id":115168,"date":"2024-04-19T02:30:08","date_gmt":"2024-04-19T00:30:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu"},"modified":"2024-04-19T02:30:08","modified_gmt":"2024-04-19T00:30:08","slug":"uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","title":{"rendered":"Vulnerability in flatpak allows bypassing sandbox isolation","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2024-32462) has been identified in the Flatpak toolkit, which is designed for creating self-contained packages that are not bound to specific Linux distributions and are isolated from the rest of the system. This vulnerability enables a malicious or compromised application delivered in a flatpak package to circumvent the established sandbox isolation mode and access files in the host system. The issue only manifests in packages that utilize Freedesktop portals (xdg-desktop-portal), which are used to facilitate access to user environment resources from isolated applications. The vulnerability has been resolved in corrective updates of flatpak 1.15.8, 1.14.6, 1.12.9, and 1.10.9. A workaround for protection has also been proposed in the releases of xdg-desktop-portal 1.16.1 and 1.18.4. <\/p>\n
Due to the vulnerability, an application running in an isolated environment can use the xdg-desktop-portal interface to create a .desktop file with a launch command from flatpak, allowing access to files on the main system. To exit the isolated environment, manipulations with the «--command» parameter are used, which is applied to pass the name of the program located inside the flatpak package that needs to be launched in the isolated environment. For example, to run the ls utility in the isolated environment of the package, you can use the command «flatpak run --command=ls org.gnome.gedit» which will result in the execution of «bwrap <isolation_parameters> ls». <\/p>\n
The essence of the vulnerability is that if the program's name starts with the characters «--«, it will be interpreted by the bwrap utility as its own option. For example, executing «flatpak run --command=--bind org.gnome.gedit \/ \/host ls -l \/host» will result in «bwrap <isolation_parameters> --bind \/ \/host ls -l \/host» being executed, meaning that the name «--bind» will be processed not as the name of the application being launched, but as an option for bwrap. <\/p>\n
The vulnerability is exacerbated by the fact that the D-Bus interface «org.freedesktop.portal.Background.RequestBackground» allows applications from the Flatpak package to specify any command for execution using «flatpak run --command», including those that start with the character «--«. It was assumed that passing any commands is safe, as they would be executed in the isolated environment of the package. However, it was not taken into account that commands starting with «--» would be processed as options by the bwrap utility. As a result, the xdg-desktop-portal interface can be used to create a .desktop file with a command that exploits the vulnerability. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"