CVE-2020-12878

Digi ConnectPort X2e < 3.2.30.6 symlink privilege escalation via /etc/init.d/S50dropbear.sh and /WEB/python/.ssh

• CVSS 7.8
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• Authentication, Authorization, and Session Management
• Local

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory.

CVE

CVE-2020-12878

CWE

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CVSS base score

7.8

Published

2021-02-18

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update Digi ConnectPort X2e to version 3.2.30.6 or higher.

import os

def ssh_directory():
    ssh_dir = '/WEB/python/.ssh'
    
    os.makedirs(ssh_dir, exist_ok=True)

    os.symlink('/etc/passwd', os.path.join(ssh_dir, 'authorized_keys'))

    os.system('chown root:root ' + ssh_dir)

ssh_directory()

import os
import stat

def ssh_directory():
    ssh_dir = '/WEB/python/.ssh'
    
    if not os.path.exists(ssh_dir):
        os.makedirs(ssh_dir)
    
    os.chmod(ssh_dir, stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR)

    authorized_keys_path = os.path.join(ssh_dir, 'authorized_keys')
    
    if not os.path.exists(authorized_keys_path):
        with open(authorized_keys_path, 'w') as f:
            f.write('')

    os.chmod(authorized_keys_path, stat.S_IRUSR | stat.S_IWUSR)

ssh_directory()

@misc{vaitp:cve202012878,
  title        = {{Digi ConnectPort X2e < 3.2.30.6 symlink privilege escalation via /etc/init.d/S50dropbear.sh and /WEB/python/.ssh}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-12878},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-12878/}}
}