CVE-2018-0023

JSNAPy <1.3.0 on GitHub: World-writable files

• CVSS 5.5
• CWE-276 Incorrect Default Permissions
• Authentication, Authorization, and Session Management
• Local

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows unprivileged local users to alter the files under this directory including inserting operations not intended by the package maintainer, system administrator, or other users. This issue only affects users who downloaded and installed JSNAPy from github.

CVE

CVE-2018-0023

CWE

CWE-276 Incorrect Default Permissions

CVSS base score

5.5

Published

2018-04-11

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update JSNAPy to version 1.3.0 or higher.

import os

def jsnapy_directory(directory):
    os.makedirs(directory, mode=0o777)

    config_file_path = os.path.join(directory, 'sample_config.yml')
    with open(config_file_path, 'w') as config_file:
        config_file.write('sample_config: value\n')

jsnapy_directory('/path/to/jsnapy/config')

import os
import stat

def jsnapy_directory(directory):
    os.chmod(directory, stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR | 
                      stat.S_IRGRP | stat.S_IXGRP)

    for root, dirs, files in os.walk(directory):
        for dir_name in dirs:
            dir_path = os.path.join(root, dir_name)
            os.chmod(dir_path, stat.S_IRUSR | stat.S_IXUSR | stat.S_IRGRP | stat.S_IXGRP)

        for file_name in files:
            file_path = os.path.join(root, file_name)
            os.chmod(file_path, stat.S_IRUSR | stat.S_IWUSR)


jsnapy_directory('/path/to/jsnapy/config')

@misc{vaitp:cve20180023,
  title        = {{JSNAPy <1.3.0 on GitHub: World-writable files}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2018},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-0023},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-0023/}}
}