CVE-2021-25322

Local attacker escalates privileges via symbolic link vulnerability in python-HyperKitty on openSUSE Leap 15.2 and Factory

• CVSS 7.8
• CWE-61
• Authentication, Authorization, and Session Management
• Local

A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior versions. openSUSE Factory python-HyperKitty versions prior to 1.3.4-5.1.

CVE

CVE-2021-25322

CWE

CWE-61

CVSS base score

7.8

Published

2021-06-10

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update python-HyperKitty to version 1.3.4-5.1 or higher.

import os

def open_symlink(symlink_path):
    with open(symlink_path, 'r') as f:
        return f.read()

content = open_symlink('/path/to/symlink')
print(content)

import os

def open_symlink(symlink_path):
    real_path = os.path.realpath(symlink_path)
    
    directory = '/directory/'
    if not real_path.startswith(os.path.abspath(directory)):
        raise ValueError("Unsafe symlink target: {}".format(real_path))
    
    with open(real_path, 'r') as f:
        return f.read()

try:
    content = open_symlink('/path/to/symlink')
    print(content)
except ValueError as e:
    print(e)

@misc{vaitp:cve202125322,
  title        = {{Local attacker escalates privileges via symbolic link vulnerability in python-HyperKitty on openSUSE Leap 15.2 and Factory}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-25322},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-25322/}}
}